Summary

• Adds copilot as a new supported agent provider following the existing provider pattern (claude, codex, opencode)
• Copilot CLI manages its own API communication to *.githubcopilot.com, so no inference routing changes are needed
• Supports credential discovery via COPILOT_GITHUB_TOKEN, GH_TOKEN, and GITHUB_TOKEN env vars

Related Issue

N/A — new agent support request.

Changes

• New file: crates/openshell-providers/src/providers/copilot.rs — CopilotProvider struct with credential discovery and unit test
• Registry: Registered CopilotProvider in ProviderRegistry::new()
• Normalization: Added copilot, gh-copilot, github-copilot aliases
• Command detection: Added two-token gh copilot wrapper detection before existing single-token logic; gh alone still resolves to github
• Network policy: Added copilot block in sandbox-policy.yaml with GitHub/Copilot API endpoints and binary paths (npm, brew, user-local, node, gh)
• Docs: Updated supported-agents.md, README.md (quickstart, tools table, providers section, supported agents table)

Testing

• New unit test: discovers_copilot_env_credentials
• New normalization assertions: copilot, gh-copilot, github-copilot
• New command detection assertions: standalone copilot, /usr/local/bin/copilot, gh copilot wrapper, gh alone still maps to github

Checklist

• Follows existing provider pattern (modeled after codex.rs)
• Conventional commit format
• Documentation updated
• No secrets or credentials committed