Summary

Applies the shared lockdown author check to pull_request_read's get_diff/get_files, and fixes an empty-author edge in get_reviews.

Why

Part of https://github.com/github/copilot-mcp-core/issues/1798 - these two read branches didn't apply the lockdown check, and the get_reviews didn't drop reviews with an empty author on an all-empty page.

What changed

• Add enforcePullRequestLockdown (fetches the PR to resolve the author under lockdown, then applies authorLockdownResult); use it in GetPullRequestDiff and GetPullRequestFiles.
• GetPullRequestReviews: drop reviews with an empty author login and hoist the filtered-slice assignment out of the loop so an all-empty page returns an empty list.
• Tests: lockdown allow/deny for diff/files, a PR-fetch-failure case, and an all-empty-author reviews regression.

MCP impact

• Tool schema or behavior changed - no schema change; under lockdown, diff/files for a PR whose author lacks push access are now withheld (consistent with GetPullRequest).

Prompts tested (tool changes only)

• "Get the diff for PR X from Y" with lockdown mode enabled/disabled
• "Get the changed files for PR X from Y" with lockdown mode enabled/disabled

Security / limits

• Data exposure, filtering, or token/size limits considered - extends existing lockdown filtering and fixes an empty-author edge in get_reviews; no change outside lockdown mode.

Tool renaming

• I am not renaming tools as part of this PR

Lint & tests

• Linted locally with ./script/lint
• Tested locally with ./script/test

Docs

• Not needed