[Astro-Han]

Summary

• add the stable github-copilot provider as a complete registry, catalog, account, model-selection, runtime, CLI, storage, and headless slice
• import an existing GitHub OAuth or fine-grained account credential through the shared oauth_token lifecycle, validate it against the Copilot subscription /models endpoint, and preserve each account-advertised model protocol
• keep GitHub Copilot subscription traffic strictly separate from the retired GitHub Models inference API, including direct api.githubcopilot.com discovery/inference headers and fail-closed organization-policy handling
• vendor the upstream GitHub Copilot SVG byte-for-byte with immutable provenance, SHA-256, license/trademark notes, and the existing renderer notice/mask seams
• keep the OpenCode Harbor route explicitly unsupported rather than retaining an unaudited parallel credential path

Refs #860

Verification

• npm run build (Node 24)
• npm run typecheck (Node 24)
• npm test (Node 24): all workspaces pass, including Desktop 2486/2486
• npm run check:stale
• renderer third-party notice check via Desktop build
• focused runtime provider conformance, Desktop subscription, and headless Harbor tests after the final rebase
• git diff --check origin/main...HEAD
• sanitized live smoke with an existing local login: GET https://api.githubcopilot.com/models returned 200 and 29 models; no token or response body was logged
• named reviewer: 0 P0–P3 after the final rebase

Local Desktop E2E was not run; CI remains the E2E merge gate.

Security and compatibility

• no secrets or raw provider responses are committed, logged, placed on argv, or copied into Harbor task containers
• classic PATs and accounts without Copilot Requests/subscription access fail closed
• GitHub Models (models.github.ai/inference) is not used
• no Phase 7 contract-foundation work is included