setup-copilot-devcontainer

SUSPICIOUS: the core Copilot setup is mostly coherent and uses GitHub’s official installer path, so it is not outright malicious. The main security concern is disproportionate optional skill-sync: it turns a Copilot devcontainer helper into a persistent installer of third-party skills on every start, creating transitive trust and credential exposure risk. Official curl|bash installer adds supply-chain risk but is same-org and documented, so it is a medium install-trust issue rather than malware evidence.