Apply lockdown check to issue_read get_labels

[kerobbi]

Note

Stacked on #2881.

Summary

Applies the shared lockdown author check to issue_read's  get_labels.

Why

Part of https://github.com/github/copilot-mcp-core/issues/1798 - get_labels was the one issue_read branch not applying the lockdown check, this makes the tool uniform.

What changed

• GetIssueLabels now takes deps, fetches the issue author{ login } in the same GraphQL query, and gates the result via authorLockdownResult under lockdown mode.
• Tests: author parameterised mock plus lockdown allow/deny cases.

MCP impact

• Tool schema or behavior changed - no schema change; under lockdown, labels for an issue whose author lacks push access are now withheld (consistent with GetIssue).

Prompts tested (tool changes only)

• "Get all labels on issue X from Y" with lockdown mode enabled/disabled

Security / limits

• Data exposure, filtering, or token/size limits considered - extends existing lockdown filtering; no change outside lockdown mode.

Tool renaming

• I am not renaming tools as part of this PR

Lint & tests

• Linted locally with ./script/lint
• Tested locally with ./script/test

Docs

• Not needed

[Copilot]

Pull request overview

This PR brings issue_read’s get_labels method in line with the rest of the issue read paths by enforcing the shared lockdown-mode author verification (introduced in the stacked PR #2881). Under lockdown mode, label results are now withheld unless the issue author can be verified as “safe content” (e.g., has push access), matching the behavior of GetIssue.

Changes:

• Routed issue_read.get_labels through the updated GetIssueLabels signature that accepts deps.
• Extended the GraphQL query used by GetIssueLabels to fetch author { login } and applied authorLockdownResult(...) gating when LockdownMode is enabled.
• Updated unit tests to mock the author login and validate lockdown allow/deny behavior.

Show a summary per file

File	Description
pkg/github/issues.go	Passes deps into GetIssueLabels, fetches issue author login via GraphQL, and gates label results with authorLockdownResult in lockdown mode.
pkg/github/issues_test.go	Adds a parameterized GraphQL mock that includes author login and introduces lockdown-mode tests for allowed/denied label access.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Low