[Repo Assist] refactor(rust-guard): add tool_names constants for codespace/gist/deploy-key tools

[github-actions]

🤖 This is an automated PR from Repo Assist.

Closes #14588

Adds tool_names constants (CREATE/UPDATE/DELETE/STOP_CODESPACE, DELETE_GIST, ADD/DELETE_DEPLOY_KEY) and uses them in production code in lib.rs, labels/tool_rules.rs and the write-operation lists in tools.rs, matching the existing pattern for other tool groups. Literals in tests are left unchanged. Constant assertions were added to the existing constants test. No behavior change. tools.rs has some rustfmt comment realignment from cargo fmt.

Test Status

• cargo fmt applied; cargo test in guards/github-guard/rust-guard: 675 passed, 0 failed.
• Go build/tests not run (no Go changes).

Generated by Repo Assist · copilot · auto · 44.5 AIC · ⊞ 18.8K · ◷
_{Comment /repo-assist to run again}

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/repo-assist.md@851905c06e905bf362a9f6cc54f912e3df747d55

[Copilot]

🟢 Approval recommended

The refactor consistently replaces literals with equivalent tested constants and introduces no behavioral change.

0 open findings

What changed in this PR

Centralizes security-sensitive Rust guard tool names without changing behavior.

Changes:

• Adds seven canonical tool_names constants and assertions.
• Replaces production literals in scope inference, DIFC labeling, and write-operation lists.

File	Description
labels/​constants.rs	Adds constants and value assertions.
labels/​tool_rules.rs	Uses constants in labeling rules.
lib.rs	Uses constants for Codespaces scope inference.
tools.rs	Uses constants in CLI write operations.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues, list_pull_requests, get_file_contents, list_commits)	data returned	ALLOWED	✅
B	MCP	writes (star/issue/comment/branch/file/PR)	all 6 write tools absent from catalog (23 read-only tools); direct calls → unknown tool	BLOCKED	⚠️
C	CLI	reads (same as A via gateway github CLI on PATH)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment)	gh unauthenticated (no GH_TOKEN) — not attempted	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated — not attempted	BLOCKED	⚠️

Overall: INCONCLUSIVE

No write, reaction, star, issue, comment, branch, file, or PR was created or leaked. Gaps: (1) Part B — the backend GitHub MCP server runs with GITHUB_READ_ONLY=1 (gh-aw's tools.github: wrapper), so write tools never enter the catalog, meaning the gateway's own DIFC write-blocking layer wasn't independently exercised on this surface. (2) Parts D/E — gh CLI has no GH_TOKEN in this environment, so REST/GraphQL write-rejection via token scope could not be tested at all.

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime