feat(providers): add GitHub Copilot CLI agent provider

[htekdev]

Summary

• Adds copilot as a new supported agent provider following the existing provider pattern (claude, codex, opencode)
• Copilot CLI is a standalone copilot binary — it manages its own API communication to *.githubcopilot.com, so no inference routing changes are needed
• Supports credential discovery via COPILOT_GITHUB_TOKEN, GH_TOKEN, and GITHUB_TOKEN env vars

Related Issue

N/A — new agent support request.

Changes

• New file: crates/openshell-providers/src/providers/copilot.rs — CopilotProvider struct with credential discovery and unit test
• Registry: Registered CopilotProvider in ProviderRegistry::new()
• Normalization: Added copilot as a recognized provider type
• Command detection: Standalone copilot binary detection (including full path resolution); gh alone still resolves to github
• Network policy: Added copilot block in sandbox-policy.yaml with endpoints from GitHub's official Copilot allowlist reference:
  • github.com, api.github.com (auth, user management)
  • api.githubcopilot.com, api.individual.githubcopilot.com, api.business.githubcopilot.com, api.enterprise.githubcopilot.com (subscription-based API routing)
  • copilot-proxy.githubusercontent.com, origin-tracker.githubusercontent.com (model proxy)
  • copilot-telemetry.githubusercontent.com, default.exp-tas.com (telemetry, feature flags)
  • release-assets.githubusercontent.com (binary updates)
• Binary paths: npm global install (/usr/lib/node_modules/@github/copilot/...), /usr/local/bin/copilot, ~/.local/bin/copilot, /usr/bin/node
• Docs: Updated supported-agents.md, README.md (quickstart, tools table, providers section, supported agents table)

Testing

• New unit test: discovers_copilot_env_credentials
• New normalization assertion: copilot
• New command detection assertions: standalone copilot, /usr/local/bin/copilot, gh alone still maps to github

Checklist

• Follows existing provider pattern (modeled after codex.rs)
• Conventional commit format
• Documentation updated
• Network policy sourced from official GitHub allowlist docs
• No secrets or credentials committed

[github-actions]

Thank you for your interest in contributing to OpenShell, @htekdev.

This project uses a vouch system for first-time contributors. Before submitting a pull request, you need to be vouched by a maintainer.

To get vouched:

1. Open a Vouch Request discussion.
2. Describe what you want to change and why.
3. Write in your own words — do not have an AI generate the request.
4. A maintainer will comment /vouch if approved.
5. Once vouched, open a new PR (preferred) or reopen this one after a few minutes.

See CONTRIBUTING.md for details.

[github-actions]

All contributors have signed the DCO ✍️ ✅
_{Posted by the DCO Assistant Lite bot.}

[htekdev]

I have read the DCO document and I hereby sign the DCO.

[johntmyers]

That policy is only for testing. I would recommend creating a new sandbox template here: https://github.com/NVIDIA/OpenShell-community where you can ensure co-pilot installs on the image and you can provide a default policy to be used. The other templates should give you a good blueprint for doing that. Not a blocker to adding this as a provider here but I think is useful for anyone wanting to get up and running quickly.

[htekdev]

That policy is only for testing. I would recommend creating a new sandbox template here: https://github.com/NVIDIA/OpenShell-community where you can ensure co-pilot installs on the image and you can provide a default policy to be used. The other templates should give you a good blueprint for doing that. Not a blocker to adding this as a provider here but I think is useful for anyone wanting to get up and running quickly.

We have another PR coming for that one too.

NVIDIA/OpenShell-Community#47