feat(safeoutputs): add GitHub issue mutation family

AGENTS.md

@@ -201,25 +201,38 @@ fail-closed and only pauses when the agent actually proposed a reviewed output.
 │   ├── safe_outputs/     # Safe-output MCP tool implementations (Stage 1 → NDJSON → Stage 3)
 │   │   ├── mod.rs
 │   │   ├── add_build_tag.rs
+│   │   ├── add_github_issue_labels.rs
 │   │   ├── add_pr_comment.rs
+│   │   ├── assign_github_issue_milestone.rs
+│   │   ├── assign_github_issue_to_user.rs
+│   │   ├── close_github_issue.rs
+│   │   ├── comment_on_github_issue.rs
 │   │   ├── comment_on_work_item.rs
 │   │   ├── create_branch.rs
 │   │   ├── create_git_tag.rs
 │   │   ├── create_github_issue.rs
 │   │   ├── create_pull_request.rs
 │   │   ├── create_wiki_page.rs
 │   │   ├── create_work_item.rs
+│   │   ├── github_api.rs # Shared GitHub REST/GraphQL client, endpoint derivation, pagination, and errors
+│   │   ├── github_issue_common.rs # Shared repository selection, filters, issue/PR policy, and temporary-ID resolution
+│   │   ├── hide_github_issue_comment.rs
+│   │   ├── link_github_sub_issue.rs
 │   │   ├── link_work_items.rs
 │   │   ├── missing_data.rs
 │   │   ├── missing_tool.rs
 │   │   ├── noop.rs
 │   │   ├── queue_build.rs
+│   │   ├── remove_github_issue_labels.rs
 │   │   ├── reply_to_pr_comment.rs
 │   │   ├── report_incomplete.rs
 │   │   ├── resolve_pr_thread.rs
 │   │   ├── result.rs
+│   │   ├── set_github_issue_field.rs
 │   │   ├── set_github_issue_type.rs
 │   │   ├── submit_pr_review.rs
+│   │   ├── unassign_github_issue_from_user.rs
+│   │   ├── update_github_issue.rs
 │   │   ├── update_pr.rs
 │   │   ├── update_wiki_page.rs
 │   │   ├── update_work_item.rs

README.md

@@ -581,6 +581,17 @@ actions, and the executor processes them after threat analysis.
 | `upload-workitem-attachment` | Uploads a workspace file as an attachment to a work item |
 | `create-github-issue` | Creates a GitHub issue (Stage 3 only; needs a separate GitHub write token) |
 | `set-github-issue-type` | Sets or clears a native GitHub Issue Type on an issue |
+| `comment-on-github-issue` | Comments on a GitHub issue or permitted pull request |
+| `hide-github-issue-comment` | Minimizes a GitHub issue, PR, or discussion comment |
+| `add-github-issue-labels` | Adds policy-approved labels to a GitHub issue or permitted PR |
+| `remove-github-issue-labels` | Removes policy-approved labels from a GitHub issue |
+| `close-github-issue` | Closes a GitHub issue, optionally with a comment or duplicate relationship |
+| `update-github-issue` | Updates operator-enabled fields on a GitHub issue or pull request |
+| `set-github-issue-field` | Sets a repository-defined GitHub issue field |
+| `assign-github-issue-milestone` | Assigns an existing or policy-approved new milestone |
+| `assign-github-issue-to-user` | Assigns policy-approved GitHub users |
+| `unassign-github-issue-from-user` | Removes policy-approved GitHub assignees |
+| `link-github-sub-issue` | Links two same-repository GitHub issues as parent and child |
 | `report-incomplete` | Reports that a task could not be completed |
 | `noop` | Reports no action was needed |
 | `missing-data` | Reports required data was unavailable |
@@ -631,25 +642,50 @@ safe-outputs:
 
 ### Example: GitHub Issue Configuration
 
-Unlike every other safe output, `create-github-issue` and `set-github-issue-type`
-write to **GitHub**, not Azure DevOps, and only run in Stage 3 with a dedicated
-GitHub write token — the Agent and Detection stages never see it:
+The thirteen GitHub-qualified issue tools write to **GitHub**, not Azure
+DevOps, and run only in Stage 3 with a dedicated GitHub write token — the Agent
+and Detection stages never see it. Tools are configured-only; auth alone does
+not expose routes.
 
 ```yaml
 safe-outputs:
+  require-approval: true
   create-github-issue:
     target-repo: octo-org/octo-repo   # required unless the ADO build source is that GitHub repo
+    allowed-repos: [octo-org/other-repo]
     allowed-labels: ["agent-*", bug]
     require-temporary-id: true
+  comment-on-github-issue:
+    target-repo: octo-org/octo-repo
+    required-labels: [agent-managed]
+    hide-older-comments: true
+    pull-requests: false
+  add-github-issue-labels:
+    target-repo: octo-org/octo-repo
+    allowed: ["agent-*", bug]
+    blocked: [security]
   set-github-issue-type:
     target-repo: octo-org/octo-repo
     allowed: [Bug, Feature, Task]
 ```
 
 Set the write token once with `ado-aw secrets set ADO_AW_GITHUB_TOKEN <token>`
-(needs **Issues: read and write** on the target repo). See
+(grant Issues, Pull requests, and Discussions write only for enabled
+capabilities), or configure a shared/dedicated GitHub App; App tokens are
+repository-scoped, minimum-permission, and revoked after execution.
+
+An agent may select `repository` only from exact `target-repo` /
+`allowed-repos` values. Existing-object mutations can require all configured
+labels and a title prefix before the first write. Same-run `#aw_...` temporary
+IDs retain their creation repository, and every configured consumer must share
+`create-github-issue`'s effective approval group.
+
+Most operations use REST. Comment minimization, duplicate marking, issue
+fields, and sub-issues require GraphQL and may depend on the GHES version;
+unsupported APIs fail explicitly rather than skipping the requested mutation.
+See
 [the site reference](https://githubnext.github.io/ado-aw/reference/safe-outputs/#github-issue-safe-outputs)
-for GitHub App auth and temporary-ID linkage between the two tools.
+for the complete tool/configuration matrix, defaults, filters, and auth setup.
 
 ### Threat Detection (`threat-detection`)