Add create_pull_request_with_copilot to WRITE_OPERATIONS and add test

Address review feedback:
- Add create_pull_request_with_copilot to WRITE_OPERATIONS in tools.rs
  so label_resource emits operation="write", matching DIFC enforcement
  for other PR creation tools.
- Add unit test for create_pull_request_with_copilot writer integrity
  in tool_rules, mirroring the existing create_pull_request test.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: lpcox

guards/github-guard/rust-guard/src/labels/mod.rs

@@ -4381,6 +4381,31 @@ mod tests {
         assert_eq!(integrity, writer_integrity(repo_id, &ctx), "create_pull_request should have writer integrity");
     }
 
+    #[test]
+    fn test_apply_tool_labels_create_pull_request_with_copilot_writer_integrity() {
+        let ctx = default_ctx();
+        let repo_id = "github/copilot";
+        let tool_args = json!({
+            "owner": "github",
+            "repo": "copilot",
+            "title": "test PR",
+            "head": "feature",
+            "base": "main"
+        });
+
+        let (_secrecy, integrity, _desc) = apply_tool_labels(
+            "create_pull_request_with_copilot",
+            &tool_args,
+            repo_id,
+            vec![],
+            vec![],
+            String::new(),
+            &ctx,
+        );
+
+        assert_eq!(integrity, writer_integrity(repo_id, &ctx), "create_pull_request_with_copilot should have writer integrity");
+    }
+
     #[test]
     fn test_apply_tool_labels_merge_pull_request_writer_integrity() {
         let ctx = default_ctx();

guards/github-guard/rust-guard/src/tools.rs

@@ -12,6 +12,7 @@ pub const WRITE_OPERATIONS: &[&str] = &[
     "delete_file",
     "fork_repository",
     "create_pull_request",
+    "create_pull_request_with_copilot",
     "add_comment_to_pending_review",
     "add_reply_to_pull_request_comment",
     "request_copilot_review",