feat: Add CSV output format for default list tools under insiders mode

[RossTarrant]

Summary

Adds feature-gated CSV output for default list_* tools and refactors Insiders mode into a feature flag bundle.

Why

CSV provides a flatter, more compact representation for list-style responses, helping evaluate token reduction from output format changes.

Refs github/copilot-mcp-core#1323

What changed

• Added csv_output as an allowed Insiders feature flag.
• Added feature-gated JSON/CSV variants for list_* tools.
• Added central JSON text response to CSV conversion with dot-notation flattening for nested objects.
• Normalised whitespace in body fields for CSV output.
• Refactored Insiders mode so it expands to curated feature flags instead of being checked directly by tools.
• Added ifc_labels as an Insiders-enabled feature flag.
• Updated MCP Apps and IFC gates to check concrete feature flags.
• Added unit coverage for CSV conversion, feature-gated variants, and Insiders feature expansion.

MCP impact

• No tool or API changes
• Tool schema or behavior changed
  CSV mode changes list_* tool (within default toolset) response behavior under the csv_output Insiders feature flag. Tool schemas are unchanged; CSV output is server-controlled by feature flag gating.
• New tool added

Prompts tested (tool changes only)

• "List discussions in RossTarrant/octopus-mcp"
• "List issues in github/github-mcp-server"
• "List pull requests in github/github-mcp-server"

Security / limits

• No security or limits impact
• Auth / permissions considered
• Data exposure, filtering, or token/size limits considered
  CSV mode is intended to reduce response size for list tools. Body fields are whitespace-normalized in CSV output; full formatted content remains available through corresponding get/read tools.

Tool renaming

• I am renaming tools as part of this PR (e.g. a part of a consolidation effort)
• I have added the new tool aliases in deprecated_tool_aliases.go
• I am not renaming tools as part of this PR

Lint & tests

• Linted locally with ./script/lint
• Tested locally with ./script/test

Docs

• Not needed
• Updated (README / docs / examples) - Updated docs/insiders-features.md detailing the new experimental feature

[Copilot]

Pull request overview

Adds an Insiders-gated CSV output mode for default list_* tools, aiming to reduce response size/context for MCP clients. This is implemented by feature-flagged tool variants that convert the existing JSON text output into a flattened CSV representation.

Changes:

• Added csv_output feature flag (allowlisted and enabled by Insiders mode).
• Introduced feature-gated JSON/CSV tool variants for default-toolset list_* tools, with centralized JSON→CSV conversion (flattening + whitespace normalization).
• Wired HTTP mode CLI --features / --insiders into feature-flag resolution; added unit tests + Insiders feature documentation.

Show a summary per file

File	Description
cmd/github-mcp-server/main.go	Passes CLI --features into HTTP server config.
pkg/http/server.go	Extends HTTP server config with static enabled features; updates feature checker to combine static + header features and insiders mode.
pkg/http/server_test.go	Adds coverage for static feature/static insiders behavior in HTTP feature checker.
pkg/http/handler_test.go	Updates tests to new feature-checker signature.
pkg/github/feature_flags.go	Adds csv_output flag to allowlist + insiders expansion list.
pkg/github/tools.go	Wraps tool list construction to inject CSV-output variants for eligible tools.
pkg/github/csv_output.go	Implements JSON-text tool-result → flattened CSV conversion and tool handler wrapping.
pkg/github/csv_output_test.go	Adds unit tests for CSV conversion + feature-gated tool variants.
docs/insiders-features.md	Documents CSV output behavior, format, and how to enable it.

Copilot's findings

• Files reviewed: 9/9 changed files
• Comments generated: 1

[SamMorrowDrums]

@RossTarrant I thought in a previous version similar bit of work I had asked that insiders would be expanded to the feature flags it enables, and nothing would be gated on insiders, but the feature that it is actually related to, and insiders is just a shortcut to enabled flags. Just like all and default are meta toolsets (contain more than one toolset), insiders should just be a meta feature flag, that enables a set of feature flags, so at the point they are checked, they should be considered to be regular feature flags.

Nothing else in the codebase should need to know what insiders is. That just leaks the concept too far.

Can this PR resolve that while it's making changes to the feature checker?

[SamMorrowDrums]

I think you need to resolved the user provided enabled feature flags by the allowed features:

github-mcp-server/pkg/github/feature_flags.go

Line 36 in e953333

func ResolveFeatureFlags(enabledFeatures []string, insidersMode bool) map[string]bool {

Because insiders mode flags list should be already in there. Also can't this directly reference the list of insiders features?

github-mcp-server/pkg/github/feature_flags.go

Line 20 in e953333

var InsidersFeatureFlags = []string{