Declare 25 audited read-only actions across eight agents

[George Ng (GeorgeNgMsft)]

Allow 25 audited read actions across eight built-in agents to skip the structured dispatcher's outer effect-confirmation prompt. This expands the original eight-action pass while keeping authorization, readiness, validation, explicit confirmation requirements, and handler questions intact. Natural-language routing and dispatcher defaults are unchanged.

• Declare exact { "effects": "read-only" } policies for list inventory/content (2), weather conditions/forecast (2), Windows ipconfig help/configuration/DNS-cache display (3), GitHub read queries (12), reminder inventory (1), local-player status/queue/folder (3), PowerShell flow inventory (1), and task-flow inventory (1).
• Expand GitHub coverage to codespaces, gists, organizations, repository caches, issue lists/details, PR lists/details/merged status/checks/files, and releases. These use fixed commands; they do not edit data, download assets, run arbitrary commands, or launch a browser.
• Place bare repository search queries after -- so flag-like names such as --web remain literal input. This narrowly scoped handler fix is necessary for safe repository-aware exemptions; repository-choice prompts are preserved.
• Add exact production-manifest/schema allowlist coverage and exercise all 25 exempted handlers through the real shared structured service with disposable storage or mocked external transport. Cover unclassified siblings and PowerShell sub-schemas, explicit required overrides, auth/readiness failures, validation, authorization, disabled actions, repository questions, and inner list-deletion questions.
• Remove the rationale Markdown from the PR's file changes and keep the per-action table and manual scenarios in the author's local review documents. Tests use an explicit audited allowlist and do not depend on a local document.

Validation: affected GitHub/provider builds passed; 49 production-policy regression tests, 90 shared structured discovery/execution tests, and 158 existing GitHub argument/readiness/diagnostic/result tests passed. Pinned changed-file formatting and all four committed-diff ratchets against origin/main passed: no new lint violations, complexity, circular dependencies, focused tests, or skipped tests. No live external mutations, authentication, playback, or GUI actions were performed.

Scope remains intentionally narrow: Spotify reads can invoke interactive auth; the calendar date-range adapter needs separate work; unrestricted utility/file/script execution, GitHub token exposure and annotation-host fetching, playback controls, and mutations remain unclassified and confirmed. ipconfig is Windows-only. Only flow metadata inventories are exempted, not scripts or PowerShell namespace actions. Existing lifecycle initialization and background behavior are unchanged.

This enables unattended read scenarios, not a universal speedup claim: discovery, connection, model time, and warm NL cache hits remain separate costs. The benchmarked list policies and handlers are unchanged.