Address typed output compatibility gaps - #3433

Summary

Addresses compatibility and output-contract gaps found during final review of the typed-output stack. Existing tools keep their intended input behavior while modern clients receive more complete, accurately validated structured results.

Why

The typed-output stack adds structured contracts across existing tools for Code Mode and compound tool use. This follow-up keeps those contracts aligned with runtime behavior before release, without adding tools, scopes, or API calls.

Fixes N/A - follow-up to the stack ending at #3403.

What changed

• Preserves legacy-compatible inputs and missing-versus-empty semantics across issue, pull request, commit, repository, gist, and duplicate-search tools.
• Retains fields needed to interpret security alerts, notifications, rule suites, repository projections, reactions, and Copilot assignments.
• Tightens method-tagged Actions and ui_get schemas, restricts unused Project user fields, and runs the bundled App parser tests through the UI build check.

MCP impact

• No tool or API changes
• Tool schema or behavior changed - corrects existing input/output contracts for typed tools. Tool names, scopes, endpoints, and protocol gating are unchanged.
• New tool added

Modern clients receive corrected structured fields and stricter method/payload schemas. Legacy clients retain established handler behavior, including compatibility inputs that typed validation previously rejected.

Prompts tested (tool changes only)

• Automated equivalents of “Find duplicate issues” and repository/issue/PR reads using legacy-compatible pagination, null, zero, and ignored parameters.
• Security, notification, gist, governance, reaction, and Copilot reads with the fields needed to interpret or continue the result.
• Actions and ui_get calls across valid, missing, mismatched, and multiple method payloads, plus legacy and modern bundled App parsing.

Security / limits

• No security or limits impact
• Auth / permissions considered - existing scopes, authorization checks, endpoints, and feature gates are unchanged.
• Data exposure, filtering, or token/size limits considered - adds only selected canonical/recovery fields from existing authorized responses, removes unused Project user details from schemas, and applies the existing commit-content IFC label to blame output.

No dependency manifests or lockfiles changed. Existing UI dependency audit findings are unchanged and outside this follow-up.

Tool renaming

• I am renaming tools as part of this PR (e.g. a part of a consolidation effort)
  • I have added the new tool aliases in deprecated_tool_aliases.go
• I am not renaming tools as part of this PR

Note: if you're renaming tools, you must add the tool aliases. For more information, see the tool renaming documentation.

Lint & tests

• Linted locally with ./script/lint - passed with 0 issues.
• Tested locally with ./script/test - passed with the full race-enabled suite.

Additional validation:

• UPDATE_TOOLSNAPS=true go test ./... - passed.
• script/generate-docs - passed.
• npm --prefix ui test - passed, 11/11.
• npm --prefix ui run typecheck - passed.
• npm --prefix ui run build - passed.
• go build ./cmd/github-mcp-server ./cmd/mcpcurl - passed.
• git diff --check - passed.

Docs

• Not needed
• Updated (README / docs / examples) - updated generated tool documentation, feature-flag documentation, and intentional tool schema snapshots.