feat(providers): add copilot_cli agent-CLI LLM provider

[NamigGadir]

Summary

This PR adds a new copilot_cli provider for local GitHub Copilot CLI-backed LLM access.

It integrates with the project's existing agent-CLI provider pattern and enables:

• invoking the local copilot binary without exposing untrusted prompt content in argv
• model selection via SKILLSPECTOR_MODEL
• strict capability stripping and secure subprocess execution
• JSON-based response parsing and auth checks consistent with other agent CLI providers

Why

Some users want to run model inference through the local GitHub Copilot CLI instead of a remote API. This keeps the provider consistent with the existing claude_cli, codex_cli, gemini_cli, and opencode_cli integrations while preserving the project's hardened security model.

Changes

• Added copilot_cli provider registration
• Added Copilot CLI argv builder, output parser, and auth checks
• Integrated provider support into model creation flow
• Updated docs and provider lists
• Added unit tests covering CLI args, output parsing, auth validation, and security invariants

Validation

• pytest tests/unit/test_agent_cli.py

[Yoseph-Zuskin]

Hi @NamigGadir, thanks for working on this — always good to see independent interest in a Copilot provider. Flagging that #572 has been under active maintainer review for a while and already covers this ground with the controls the review has required: exact version pin with per-completion preflight, home and XDG migration-source hook audits, env scrubbing, adversarial transport tests, and live verification on 1.0.88 and 1.0.89. Your auth check (existing ~/.copilot directory counts as authenticated) and the missing version gate would both block on the bar set in those rounds. Suggest closing this in favor of #572 — happy to collaborate there. Two ideas of yours I'd like to evaluate as follow-ups on Yoseph-Zuskin:feat/copilot-cli-provider: --disallow-temp-dir and =-form variadic flags (both confirmed present on 1.0.89). Also noting our parsers expect different event shapes (item.completed vs your assistant.message), which may be version-dependent and worth comparing notes on.

[NamigGadir]

Thanks @Yoseph-Zuskin for flagging #572! I didn't realize there was already an active PR in review for copilot_cli. Makes total sense regarding the strict version gate and preflight requirements.
Glad to hear --disallow-temp-dir and the = variadic flags are helpful! I'll close this PR in favor of #572 and am happy to help review or collaborate over on #572. Will close my pr and wait for merging your pr. Thank you very much for replying me.