feat(providers): add GitHub Copilot subscription OAuth (device flow + copilot-token re-mint)

28th platform `github-copilot` (uses_oauth, ChatCompletions wire). Two-stage auth:
RFC-8628 GitHub device flow (client Iv1.b507a08c87ecfe98, scope read:user, errors
in a 200 body) mints the DURABLE github token; a GET api.github.com/copilot_internal/
v2/token exchange re-mints the SHORT-LIVED copilot token. Persisted as key=copilot
token, refresh_token=github token, expires_at=copilot expiry; the "refresh" is a
copilot-token re-mint (not a refresh_token grant), dispatched via
OAuthTokenBody::GithubCopilotExchange in the generic refresher.

VS Code editor-identity headers on /models + /chat/completions, gated on
SamplerConfig.github_copilot / PlatformId::sends_copilot_editor_headers() so every
other ChatCompletions provider stays byte-identical. Live /models filtered
(parse_github_copilot_listing) to the openai-completions-served models: keep iff
model_picker_enabled && policy.state!="disabled" && tool_calls!=false AND not a
claude-4.x/5.x (messages) or gpt-5/oswe/mai- (responses-only) id — those need
per-model wire routing (documented debt), excluded rather than mis-routed.

Inherits the leak-safe pooled routing (scope oauth/github-copilot); its bearer/
refresh/api_key never touch the Kimi token (regression test added). Fail-fast on
an out-of-range copilot expires_at (would otherwise silently 401 mid-session).
Adversarial security review: GO, no CRITICAL/HIGH. Known limitation: Pi's
per-model policy-enablement POST is not ported (documented in AGENTS.md).

crates/codegen/kigi-shell/src/agent/auth_method.rs

@@ -600,6 +600,11 @@ mod tests {
         );
         assert_eq!(
             ids[kimi_pos + 3],
+            "github-copilot",
+            "github-copilot is the next interactive OAuth login, after claude-pro-max"
+        );
+        assert_eq!(
+            ids[kimi_pos + 4],
             MOONSHOT_CN_METHOD_ID,
             "the api-key rows follow the generic oauth logins"
         );
@@ -750,6 +755,7 @@ mod tests {
                 KIMI_CODE_METHOD_ID,
                 "xai-grok",
                 "claude-pro-max",
+                "github-copilot",
                 MOONSHOT_CN_METHOD_ID,
                 MOONSHOT_AI_METHOD_ID,
                 "openai",
@@ -800,6 +806,7 @@ mod tests {
                 KIMI_CODE_METHOD_ID,
                 "xai-grok",
                 "claude-pro-max",
+                "github-copilot",
                 MOONSHOT_CN_METHOD_ID,
                 MOONSHOT_AI_METHOD_ID,
                 "openai",
@@ -843,6 +850,7 @@ mod tests {
                 KIMI_CODE_METHOD_ID,
                 "xai-grok",
                 "claude-pro-max",
+                "github-copilot",
                 MOONSHOT_CN_METHOD_ID,
                 MOONSHOT_AI_METHOD_ID,
                 "openai",
@@ -889,6 +897,7 @@ mod tests {
                 KIMI_CODE_METHOD_ID,
                 "xai-grok",
                 "claude-pro-max",
+                "github-copilot",
                 MOONSHOT_CN_METHOD_ID,
                 MOONSHOT_AI_METHOD_ID,
                 "openai",