[plan] Improve agent health and reduce firewall denials

[github-actions]

Overview

This tracking issue coordinates improvements identified in the DeepReport Intelligence Briefing to address recurring workflow failures and firewall denials.

Source: Discussion #7638 (DeepReport Intelligence Briefing - 2025-12-25)

Current State

• Success Rate: 87.9% (improved from 55.8%)
• Firewall Denial Rate: 29.7% (concerning increase)
• Top Issues:
  • Missing GitHub MCP configuration in Copilot workflows
  • safeinputs/GITHUB_TOKEN missing in Daily Copilot PR Merged
  • Build tools unavailable for Tidy workflow
  • GitHub search errors in Issue Monster

Planned Tasks

This plan breaks down the three actionable quick-wins from the intelligence briefing into focused sub-issues:

1. Fix safeinputs wiring - Resolve missing GITHUB_TOKEN in Daily Copilot PR Merged
2. Add GitHub MCP to Copilot workflows - Replace direct API access with MCP server
3. Provision build tools for Tidy - Ensure required tools are available
4. Fix GitHub search handling in Issue Monster - Add retry/error handling
5. Validate and monitor improvements - Confirm fixes reduce errors and denials

Expected Impact

• Reduce firewall denial rate from 29.7% to <10%
• Eliminate recurring missing-tool errors
• Improve workflow stability and success rates
• Reduce audit noise from build tool gaps

Success Criteria

• Daily Copilot PR Merged runs without missing-tool errors
• Copilot workflows use GitHub MCP (no api.github.com denials)
• Tidy workflow has all required build tools
• Issue Monster handles GitHub search errors gracefully
• Weekly firewall denial rate drops below 10%

AI generated by Plan Command for discussion #7638