feat: add feature-assess agentic workflow that installs and runs Spec Kit (#4186)

* feat: add feature-assess agentic workflow that installs and runs Spec Kit

Add a gh-aw agentic workflow (Copilot engine) that, when an issue is labeled
`feature-assess`, installs the Spec Kit CLI, initializes it for Copilot, installs
the `assess` extension, and runs its five-stage idea-assessment pipeline
(intake → research → define → shape → decide) against the issue. Setup and
execution are captured entirely as prose the agent runs with its bash tools —
no imperative steps: block. Each stage's artifact is posted as its own issue
comment (summarized if it exceeds the comment size limit), then one verdict
label is applied (feature-go / feature-needs-clarification / feature-kill, or
feature-invalid).

Frontmatter grants the bash commands (uv, specify, curl, …) and network egress
(python, github, astral.sh) needed for the prompt-driven install, and pins the
Copilot engine. Includes the compiled feature-assess.lock.yml (gh aw compile,
v0.79.8).

Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous)
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 2ec8128b-ee80-4222-b58a-570990994454

* fix: address PR review — reproducible install, correct failure labeling, network parity

Address the three findings from the automated review on #4186:

- Install the Spec Kit CLI from the checked-out revision ($GITHUB_WORKSPACE)
  instead of the mutable default branch, so each run uses the exact CLI and
  bundled assess instructions of the workflow commit under evaluation (with a
  pinned git+…@$GITHUB_SHA fallback). Fixes reproducibility.
- On install/network failure, stop and post a comment WITHOUT applying any
  verdict label; feature-invalid is reserved for unassessable request content,
  not operational/runner failures. Fixes mislabeling valid requests.
- Add gitlab.com, stackoverflow.com, and *.stackexchange.com to network.allowed
  so the firewall allowlist matches the hosts the prompt permits fetching from.

Recompiled feature-assess.lock.yml (gh aw compile, v0.79.8).

Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous)
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 2ec8128b-ee80-4222-b58a-570990994454

* fix: address review round 2 — gist host in allowlist, honest failure note

Address the two findings from the second automated review on #4186:

- Add gist.github.com to network.allowed. gh-aw domain entries are exact and
  the github ecosystem does not cover the gist subdomain, so gist fetches the
  URL policy permits were being blocked by the firewall. Regenerated the lock.
- Reword the comment-failure note: add_comment safe outputs are only queued
  during the agent job and delivered in a later safe_outputs job the agent
  cannot observe, so it cannot detect or report a post-time delivery failure.
  Restrict the recovery instruction to queue-time errors and defer delivery
  failures to the run logs/conclusion.

Recompiled feature-assess.lock.yml (gh aw compile, v0.79.8).

Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous)
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 2ec8128b-ee80-4222-b58a-570990994454

* fix: address review round 3 — keep exactly one verdict label on reassessment

Address the finding from the third automated review on #4186:

- add-labels only adds, so re-running the assessment (feature-assess removed
  and re-added) could leave a stale feature-* verdict alongside the new one.
  Configure remove-labels for all four verdict labels and instruct Step 7 to
  strip any existing verdict label before adding the current result, so the
  issue always carries exactly one feature-* verdict (feature-invalid included).

Recompiled feature-assess.lock.yml (gh aw compile, v0.79.8).

Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous)
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 2ec8128b-ee80-4222-b58a-570990994454

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 2ec8128b-ee80-4222-b58a-570990994454

Author: mnriem