Add GitHub Copilot privacy and coding-agent access checks #8

Problem

nosnitch can verify account-level privacy settings for OpenAI and Claude, but GitHub Copilot still requires a manual browser review. The relevant account settings include:

• whether GitHub may use Copilot inputs, outputs, and context for AI model training;
• whether Copilot cloud agent has access to no repositories, selected repositories, or all repositories; and
• whether partner coding agents such as Claude or Codex are enabled.

These settings matter independently of local coding-agent CLI privacy controls.

Scope

• Discover signed-in GitHub accounts from the supported browser cookie stores and group duplicate sessions by account.
• Read and report the Copilot license context, model-training preference, cloud-agent repository scope, and partner-agent states.
• Include the GitHub results in both the human-readable report and nosnitch check --json.
• Treat enabled personal-account model training as exposure.
• Surface broad cloud-agent or partner-agent access explicitly for review; do not automatically change repository selection or partner-agent access because the intended scope is account-specific.
• Add a confirmed write path that disables GitHub Copilot model training, consistent with the existing provider-specific training commands, and include it in nosnitch off.
• Use only first-party GitHub endpoints and never print or persist browser cookies, tokens, or CSRF values.

Acceptance criteria

• A valid signed-in GitHub browser session produces one account-centric GitHub Copilot result with the four settings above.
• Multiple browser sessions for the same GitHub account are merged without duplicating the account.
• Missing, expired, or unreadable sessions are reported as skipped or incomplete rather than clean.
• nosnitch github training asks for confirmation by default, supports --yes, disables only the Copilot model-training preference, and verifies the resulting state.
• nosnitch off includes the GitHub training opt-out but leaves cloud-agent repository selection and partner-agent switches unchanged.
• Unit tests cover parsing, account merging, risk and incomplete status, confirmation behavior, and JSON output without real credentials.
• README usage, supported-account coverage, and security notes are updated.