Document COPILOT_AGENT_SESSION_ID for stdio MCP servers, and give MCP servers a supported way to read the effective sandbox policy #5193

Describe the feature or problem you'd like to solve

A local stdio MCP server that holds a credential must keep it out of the agent's reach. Copilot's local sandbox can provide that. The server can only rely on it if it can learn, at call time, which session is calling and what that session's sandbox allows.

Proposed solution

Copilot CLI 1.0.95, used through VS Code, already appears to provide both: each session starts its own MCP server process with COPILOT_AGENT_SESSION_ID in its environment, and the runtime writes the enforced policy to ~/.copilot/session-state//policies/*.json. Neither is documented, so a server can't depend on them.

Requests:

1. Document COPILOT_AGENT_SESSION_ID as a supported interface for stdio MCP servers, with a stability commitment. Claude Code documents the equivalent CLAUDE_CODE_SESSION_ID.
2. Document a versioned schema for the per-session enforced-policy record, or expose /sandbox policy in a machine-readable form an MCP server can query. That record should include whether sandbox bypass is allowed or has been approved for the session.

Example prompts or workflows

No response

Additional context

No response