fix(lockdown): harden pull_request_read get_commits handling

[SamMorrowDrums]

Summary

pull_request_read's get_commits method returned commit messages without any lockdown check, unlike get_diff and get_files, which already restrict the whole result when the PR author lacks push access. This meant commit content from an untrusted fork PR bypassed the lockdown model applied to comparable pull request content.

Changes

• GetPullRequestCommits now calls enforcePullRequestLockdown (the same helper used by GetPullRequestDiff/GetPullRequestFiles) before listing commits, so under lockdown mode it fails closed with access to pull request is restricted by lockdown mode when the PR author lacks push access.
• Added test cases covering: lockdown disabled (existing), author lacks push access (errors), author has push access (succeeds), a trusted bot author lacking push access (succeeds, preserving the intentional exception), and PR-fetch failure under lockdown.
• Updated README.md and docs/server-configuration.md:
  • Added pull_request_read:get_diff, get_files, and get_commits to the documented list of tools that error under lockdown (the first two were already implemented this way but previously undocumented).
  • Clarified that lockdown mode is a best-effort content filter to reduce prompt-injection risk from untrusted repository content, and explicitly not an authorization boundary — it doesn't change what the underlying credential can read/write elsewhere.
  • Documented the existing intentional trusted-bot exception (github-actions[bot], copilot) that was previously implemented in pkg/lockdown/lockdown.go but never mentioned in the docs.

Design tradeoff

Commits are structurally a list with per-item authorship info (RepositoryCommit.Author), similar to reviews/comments, which are filtered per-item. However, I chose the PR-author whole-result check (same as get_diff/get_files) instead of per-commit filtering because:

• All commits on a pull request belong to the same untrusted head branch as the diff/file list — they aren't independently-authored side content like comments or reviews from arbitrary accounts.
• A single PR-author check is fail-closed and strictly more conservative than per-item filtering (which could still surface some commit messages even when the PR context as a whole is untrusted).
• It avoids an extra permission lookup per commit and reuses an already well-tested code path.

Testing

• script/lint — clean
• script/test — all packages pass
• script/generate-docs — run; no tool-schema/description changes (only manual prose edits), diff unaffected

Fixes #3105

[Copilot]

Pull request overview

Hardens pull_request_read:get_commits by applying existing lockdown protections to commit content.

Changes:

• Enforces PR-author trust checks before listing commits.
• Adds lockdown success, denial, bot-exception, and failure tests.
• Clarifies lockdown scope and limitations in documentation.

Show a summary per file

File	Description
README.md	Documents lockdown behavior and affected PR methods.
pkg/github/pullrequests.go	Applies lockdown checks to commit retrieval.
pkg/github/pullrequests_test.go	Tests commit retrieval under lockdown scenarios.
docs/server-configuration.md	Clarifies lockdown’s security model and bot exceptions.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 4/4 changed files
• Comments generated: 0
• Review effort level: Balanced