Add tool-guardian hook for Copilot

[david-mears-2]

Copied wholesale from https://github.com/github/awesome-copilot/blob/main/hooks/tool-guardian
See the README there to understand more, but the purpose is extra guardrails around Copilot, for when running it more autonomously.

I think the main thing I'd be worried about with yolo-ing (allowing copilot to run any command) is it messing up my computer or uncommitted work in irreparable ways. It could do this directly, by modifying/deleting files or uninstalling things, or indirectly by installing a malicious package. There is also a very specific risk of it posting private keys to github, which I don't address here.

My general approach thus far is to whitelist safe commands e.g. ls, npx vitest as they come up; but this is perhaps over-cautious and prevents a lot of the benefits of using AI agents, namely being able to delegate and not have to supervise (so that working in parallel is made possible). In order to feel safe doing that I'd like to do something like run copilot inside a Docker sandbox: https://docs.docker.com/ai/sandboxes/. (If using Docker sandbox I would choose the 'balanced' policy with regard to network access: https://docs.docker.com/ai/sandboxes/security/policy/#network-policies). Another way to sandbox is to run Copilot in the cloud through the GitHub website, but then it's less able to be interacted with. Further research (not yet read): https://www.reddit.com/r/devops/comments/1q4pvy6/wrote_a_deep_dive_on_sandboxing_for_ai_agents/

The bash script added in this PR is not me-authored, it's copied from that tool-guardian repo. That repo is trusted enough by GitHub to be linked in the Copilot docs.

Copilot hooks docs: https://docs.github.com/en/copilot/concepts/agents/coding-agent/about-hooks

https://docs.github.com/en/copilot/reference/hooks-configuration

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.26%. Comparing base (1ca780a) to head (cfb15cd).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #264   +/-   ##
=======================================
  Coverage   99.26%   99.26%           
=======================================
  Files         201      201           
  Lines        5820     5820           
  Branches      974      974           
=======================================
  Hits         5777     5777           
  Misses         42       42           
  Partials        1        1           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.