Summary

Extracts a single shared helper for lockdown mode author checks and routes GetIssue and GetPullRequest through it, failing closed when the author can't be verified.

Why

Part of https://github.com/github/copilot-mcp-core/issues/1798

What changed

• Added authorLockdownResult (pkg/github/lockdown.go) - one place that resolves the lockdown decision for content authored by a given login, with shared restriction messages - and routed GetIssue and GetPullRequest through it.
• Fail closed when the author login is empty (previously an empty login skipped the check); normalised GetPullRequest's error path to a tool-result error to match GetIssue.
• Added unit tests for the helper and a lockdown test for GetPullRequest.

MCP impact

• Tool schema or behavior changed - no schema change; behaviour differs only under lockdown mode (empty-author content is now withheld, matching the existing per-item filters).

Prompts tested (tool changes only)

• "Get issue X from Y" with lockdown mode enabled/disabled
• "Get PR X from Y" with lockdown mode enabled/disabled

Security / limits

• Data exposure, filtering, or token/size limits considered - consolidates the lockdown content filtering decision; no change outside this.

Tool renaming

• I am not renaming tools as part of this PR

Lint & tests

• Linted locally with ./script/lint
• Tested locally with ./script/test

Docs

• Not needed