[auto] chore: add three reviewer-derived rules to Copilot instructions

Proposed by the [Update Instructions From PR Reviews](.github/workflows/update-instructions-from-pr-reviews.md) workflow.

**Settings**
- Repo mined: `Azure/azure-dev`
- Range: merged since 2026-01-13 (last 6 months, no prior successful run found)
- Branch: `automated/update-instructions-from-pr-reviews` @ 602c349

**Stats**
- Signal ratio: ~60 non-bot comments kept / ~120 total (50%)
- Resolved PRs examined: 48

**PR comment themes promoted**

- **Dead code removal before merge** — jongio flagged unused functions/types 3× across review rounds of [#8782](https://github.com/Azure/azure-dev/pull/8782). Added to `go.instructions.md`.
- **No CRLF (`\r\n`) in generated text files** — jongio flagged unconditional Windows line endings in generated Dockerfiles/Python scripts 3× in [#8782](https://github.com/Azure/azure-dev/pull/8782). Added to `extensions.instructions.md`.
- **URL `startsWith()` validation bypassed by dot segments** — richardpark-msft flagged that raw prefix checks on URL strings are bypassable via `/../` or `%2e%2e` 3× in [#9042](https://github.com/Azure/azure-dev/pull/9042). Added to `extensions.instructions.md`.

> Generated by [Update Instructions From PR Reviews](https://github.com/Azure/azure-dev/actions/runs/29240337966) · 140.2 AIC · ⌖ 13.2 AIC · ⊞ 8K · [◷](https://github.com/search?q=repo%3AAzure%2Fazure-dev+%22gh-aw-workflow-id%3A+update-instructions-from-pr-reviews%22&type=pullrequests)

---

> [!NOTE]
> This was originally intended as a pull request, but GitHub Actions is not permitted to create or approve pull requests in this repository.
> The changes have been pushed to branch `automated/update-instructions-from-pr-reviews`.
>
> **[Click here to create the pull request](https://github.com/Azure/azure-dev/compare/main...automated/update-instructions-from-pr-reviews?expand=1&title=%5Bauto%5D%20chore%3A%20add%20three%20reviewer-derived%20rules%20to%20Copilot%20instructions)**

To fix the permissions issue, go to **Settings** → **Actions** → **General** and enable **Allow GitHub Actions to create and approve pull requests**. See also: [gh-aw FAQ](https://github.github.com/gh-aw/reference/faq/#why-is-my-create-pull-request-workflow-failing-with-github-actions-is-not-permitted-to-create-or-approve-pull-requests)

Show patch preview (69 of 69 lines)

```diff
From 602c3492eccd77aedff68cf83e1555b9c728a741 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
Date: Mon, 13 Jul 2026 09:58:05 +0000
Subject: [PATCH] chore: add three reviewer-derived rules to Copilot
instructions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

From mining 48 recently-merged PRs, three recurring reviewer themes
reached the promotion threshold:

1. Dead code removal (go.instructions.md) — jongio flagged unused
functions/types 3× in #8782.
2. CRLF in generated files (extensions.instructions.md) — jongio
flagged unconditional \\r\\n in generated files 3× in #8782.
3. URL startsWith bypass (extensions.instructions.md) — richardpark-msft
flagged dot-segment path-traversal bypasses 3× in #9042.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
.../instructions/extensions.instructions.md | 18 ++++++++++++++++++
.github/instructions/go.instructions.md | 6 ++++++
2 files changed, 24 insertions(+)

diff --git a/.github/instructions/extensions.instructions.md b/.github/instructions/extensions.instructions.md
index f46a73d..e0b43f1 100644
--- a/.github/instructions/extensions.instructions.md
+++ b/.github/instructions/extensions.instructions.md
@@ -16,3 +16,21 @@ applyTo:
- Follow extension guidelines in: cli/azd/docs/extensions/extensions-style-guide.md. If the work
violates any of these principles, include a link to the guide so the user can read it and get
ahead of some of the problems.
+
+- When generating text files (Dockerfiles, Python scripts, TOML files, etc.), never force Windows
+ line endings (`\r\n`) on all platforms. Use `\n` (Unix LF) exclusively. Unconditional CRLF breaks
+ shebang parsing inside Linux containers, causes `exec format error`, and introduces noisy git
+ diffs on Linux/macOS. If the Go `text/template` or `os.WriteFile` path writes through a
+ `strings.NewReplacer` or similar that co
... (truncated)
```

Start with the proposed branch and inspect .github/instructions/extensions.instructions.md and .github/instructions/go.instructions.md alongside their existing guidance. Confirm the three listed reviewer-derived rules are represented accurately, then review the diff to ensure only the intended instruction additions are present.

Written by the indexing model from the issue text.