Apply lockdown check to pull_request_read get_diff/get_files/get_check_runs

[kerobbi]

Note

Stacked on #2881.

Summary

Applies the shared lockdown author check to pull_request_read's get_diff/get_files/get_check_runs, and fixes an empty-author edge in get_reviews.

Why

Part of https://github.com/github/copilot-mcp-core/issues/1798 - these three read branches didn't apply the lockdown check, and the get_reviews didn't drop reviews with an empty author on an all-empty page.

What changed

• Add enforcePullRequestLockdown (fetches the PR to resolve the author under lockdown, then applies authorLockdownResult); use it in GetPullRequestDiff and GetPullRequestFiles.
• GetPullRequestCheckRuns applies the check inline using the PR it already fetches.
• GetPullRequestReviews: drop reviews with an empty author login and hoist the filtered-slice assignment out of the loop so an all-empty page returns an empty list.
• Tests: lockdown allow/deny for diff/files/check_runs, a PR-fetch-failure case, and an all-empty-author reviews regression.

MCP impact

• Tool schema or behavior changed - no schema change; under lockdown, diff/files/check_runs for a PR whose author lacks push access are now withheld (consistent with GetPullRequest).

Prompts tested (tool changes only)

• "Get the diff for PR X from Y" with lockdown mode enabled/disabled
• "Get the changed files for PR X from Y" with lockdown mode enabled/disabled
• "Get the CI check runs for PR X from Y" with lockdown mode enabled/disabled

Security / limits

• Data exposure, filtering, or token/size limits considered - extends existing lockdown filtering and fixes an empty-author edge in get_reviews; no change outside lockdown mode.

Tool renaming

• I am not renaming tools as part of this PR

Lint & tests

• Linted locally with ./script/lint
• Tested locally with ./script/test

Docs

• Not needed

[Copilot]

Pull request overview

Extends lockdown filtering to additional pull-request read operations and fixes empty-author review filtering.

Changes:

• Enforces PR-author lockdown checks for diffs, files, and check runs.
• Correctly removes reviews with empty author logins.
• Adds lockdown and regression tests.

Exported function signature changes introduce Go API compatibility issues.

Show a summary per file

File	Description
pkg/github/pullrequests.go	Adds lockdown enforcement and fixes review filtering.
pkg/github/pullrequests_test.go	Adds lockdown and empty-author coverage.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 3
• Review effort level: Medium