chore: set min-integrity on issue-triage agentic workflow

[DeagleGross]

Today depending on the rights of the user creating issue, workflow may decide to not post the results, since user does not have collaborator role on the repo. Example:

Collected 0 missing tool(s), 0 missing data item(s), 0 noop message(s), and 1 incomplete signal(s)
Processing 1 message(s) in order of appearance...
Processing message 1/1: report_incomplete
Warning: ⚠️ report_incomplete: Issue #66192 content was filtered by integrity policy — user-submitted issue body/title has lower integrity than the agent requires (integrity below "approved"). Unable to read any issue details to perform area classification, type classification, duplicate detection, or post a triage summary.
   Details: All three attempts to read the issue data returned: "Resource 'issue:dotnet/aspnetcore#66192' has lower integrity than agent requires. The agent cannot read data with integrity below 'approved'." This applies to both get and get_comments methods, as well as search_issues. The triage workflow cannot proceed without access to the issue content.
✓ Message 1 (report_incomplete) completed successfully
Stored 0 missing tool(s), 0 missing data item(s), 0 noop message(s), and 1 incomplete signal(s) for footer generation
📝 Safe output summaries written to step summary

It is safe to set min-integrity for issue-triage, since this is a readonly workflow, and allows only placing labels and a single comment on the issue.

Closes #66191

[Copilot]

Pull request overview

Updates the Issue Triage Agent agentic workflow configuration so it can read and triage newly opened issues even when the issue author/content is below the default integrity threshold.

Changes:

• Configure the workflow’s GitHub tool with min-integrity: none to allow reading user-submitted issue content.
• Regenerate the compiled lock workflow to reflect the updated integrity/guard configuration.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/issue-triage-agent.md	Sets github.min-integrity: none in the workflow frontmatter so the agent can read issue details regardless of author integrity.
.github/workflows/issue-triage-agent.lock.yml	Regenerated workflow lock output; updates MCP guard policy configuration to align with the new integrity setting.

[Copilot]

The GitHub MCP server guard policy is now hard-coded to allow "repos": "all". This broadens what the agent can read to any repository accessible by the configured token, which is likely more than this issue-triage workflow needs (it should only need dotnet/aspnetcore). Consider constraining the allowed repos (e.g., to the current repository) while keeping min-integrity: none so untrusted issues can still be read.