Summary

Allow public-repository contribution tools to work with the narrower public_repo OAuth scope while keeping repo as an accepted parent scope.

Why

Several tools currently require repo in MCP scope metadata even though GitHub permits their public-repository operations with public_repo. That makes public-only deployments request private-repository access unnecessarily.

Fixes #3136

What changed

• Use scopes.PublicRepo for fork_repository, create_branch, push_files, create_pull_request, issue_write, and add_issue_comment.
• Add public_repo to the supported OAuth scope catalogue without adding it to the default grant; repo remains the default and an accepted parent scope.
• Add focused scope-filter regression coverage and update generated documentation.

MCP impact

• No tool or API changes
• Tool schema or behavior changed
• New tool added

Tool inputs and handlers are unchanged. The change affects OAuth scope filtering and advertised scope metadata only.

Prompts tested (tool changes only)

• "Fork this public repository, create a branch, push the patch, and open a pull request."
• "Open an issue on this public repository with the reproduction steps."

Security / limits

• No security or limits impact
• Auth / permissions considered
• Data exposure, filtering, or token/size limits considered

This is a least-privilege change: public-only OAuth deployments can use public_repo without gaining private-repository access. Existing repo tokens remain compatible through the existing scope hierarchy.

Tool renaming

• I am renaming tools as part of this PR (e.g. a part of a consolidation effort)
• I am not renaming tools as part of this PR

Lint & tests

• Linted locally with ./script/lint
• Tested locally with UPDATE_TOOLSNAPS=true go test ./...

Docs

• Not needed
• Updated (README / generated docs)