feat: add GitHub Copilot SDK backend with CLI fallback

[nimide]

Summary

Add GitHub Copilot as an explicit headless LLM backend for Graphify through two transports:

• copilot-sdk — preferred structured integration using the official Python SDK and a persistent Copilot runtime.
• copilot-cli — standalone one-shot subprocess backend and automatic compatibility fallback.

The integration covers semantic extraction, LLM-assisted deduplication, community naming, PR triage, usage reporting, model selection, timeout handling, and raster-image attachments through the SDK.

Related: #959, #975, #976, #981
Prior implementation discussion: #1041

Motivation

Graphify already supports API-backed providers and a local CLI transport. Copilot users should also be able to run Graphify's semantic pass through their existing Copilot entitlement and authenticated GitHub environment without Graphify parsing or persisting OAuth credentials.

The SDK is the preferred transport because it provides structured sessions, responses, image attachments, and a long-lived runtime. The CLI adapter remains valuable for diagnostics, Python 3.10 compatibility, managed environments that do not install the Python SDK, and SDK/runtime incompatibilities.

What changed

New copilot-cli backend

• Invokes the official copilot executable with the prompt on standard input.
• Uses silent output mode and capability-detects optional hardening/model flags.
• Runs from an empty temporary working directory.
• Disables or denies tool classes and interactive behavior when supported by the installed CLI.
• Inherits normal Copilot authentication, proxy, certificate, and GitHub Enterprise host configuration.
• Runs serially by default; parallel dispatch is an explicit opt-in.

New copilot-sdk backend

• Lazily imports github-copilot-sdk>=1.0.7,<2 on Python 3.11+.
• Reuses one SDK client/runtime per Graphify process while creating a fresh isolated session for every Graphify request.
• Uses mode="empty", registers no tools or MCP servers, rejects permission requests, and disables memory, infinite sessions, configuration discovery, and remote sessions.
• Uses temporary working and state directories instead of exposing the analyzed repository as an agent workspace.
• Disconnects and permanently deletes each session after the response is received.
• Supports raster images through SDK file attachments.
• Uses a system-installed Copilot CLI by default; an SDK-managed runtime is an explicit opt-in.
• Falls back to copilot-cli on SDK import, startup, transport, timeout, session, response, or cleanup failures unless GRAPHIFY_COPILOT_SDK_FALLBACK=0 is set.
• Treats strict SDK-only operation as an explicit policy choice; because a timeout can be ambiguous, deployments that must avoid a possible replay can disable fallback.

Integration, packaging, and portability

• Adds both backends to extraction, deduplication, labeling, and PR-triage dispatch.
• Adds backend/model/timeout help and configuration documentation.
• Adds a copilot optional dependency extra while retaining Graphify's Python 3.10 floor.
• Updates uv.lock, including the Python 3.11 marker for github-copilot-sdk==1.0.7.
• Updates generated skill references and their expected artifacts.
• Normalizes model-facing corpus paths to POSIX-style separators so prompts and source_file values are stable across Windows and POSIX systems.
• Makes symlink-boundary tests skip only when Windows explicitly denies symlink creation, while retaining the security coverage on platforms that support it.
• Adds focused tests for lifecycle, isolation, fallback, model precedence, enterprise-host propagation, images, errors, and adjacent Graphify integrations.

Usage

Development install:

uv sync --extra copilot --frozen

Use an existing GitHub.com login, or authenticate to a GitHub Enterprise Cloud data-residency host:

copilot login --host https://example.ghe.com
export COPILOT_GH_HOST=example.ghe.com

Run the preferred SDK backend:

graphify extract ./docs --backend copilot-sdk --model auto

Select the CLI transport directly:

graphify extract ./docs --backend copilot-cli --model auto

Require SDK success and disable fallback:

export GRAPHIFY_COPILOT_SDK_FALLBACK=0

Compatibility

• Graphify continues to support Python 3.10.
• The optional Python SDK dependency is installed only on Python 3.11+.
• On Python 3.10, selecting copilot-sdk can use the direct CLI fallback; copilot-cli remains directly selectable.
• Neither Copilot backend is auto-selected merely because a package or executable is installed. Corpus content is sent through Copilot only after the user explicitly chooses one of these backends.

Security and privacy behavior

• Graphify does not read or store Copilot's persisted OAuth credential.
• SDK sessions have no registered Graphify tools or MCP servers, and every permission request is rejected.
• Temporary session state is removed and SDK session deletion is verified before accepting a successful response.
• Enterprise host, proxy, certificate, and authentication environment settings are inherited rather than hard-coded.
• Selecting either backend transmits semantic-pass content to the Copilot service associated with the authenticated account; code-only AST extraction remains local as before.

Validation

Focused and adjacent regression suite:

369 passed in 21.66s

Additional checks:

python -m compileall -q graphify tests tools
python -m tools.skillgen --check
  check OK: 134 artifact(s) match committed output and expected/.
python -m tools.skillgen --schema-singleton
  schema-singleton OK
uv export --extra copilot --frozen --no-dev --no-hashes
  github-copilot-sdk==1.0.7 on Python >=3.11
git diff --check

A bounded extraction-CLI comparison produced the same 20 environment-related failures on the unchanged source snapshot and the feature branch. Those tests require tree-sitter packages that were unavailable in the offline validation environment, and several spawn an isolated interpreter where the checkout was not installed. No Copilot backend test failed.

A live Copilot request was not made from the validation environment because it had no authenticated Copilot account or approved test corpus. SDK and CLI behavior was exercised with controlled protocol/subprocess fakes.

Checklist

• Changelog and user documentation updated.
• Generic GitHub Enterprise setup documented without an organization-specific hostname.
• Optional dependency and frozen lockfile updated.
• Generated skill artifacts regenerated and checked.
• New backend and integration tests added.
• Existing adjacent LLM/backend tests pass.
• Model-facing paths are normalized and covered by a Windows-path regression test.
• No credentials or tokens committed.