Spike: confirm the supported tokenless Copilot auth mechanism

> 🤖 Generated by the Agentic Engineer

Part of #6457.

## Why this is a Spike and not a PR

The Epic assumes delegating to the Copilot CLI's OAuth is sufficient, and that a GitHub App
installation token cannot carry a Copilot seat. Both are *reasoned* from the SDK architecture and
from how Copilot entitlement is licensed — neither has been demonstrated here. Building three
interfaces on an unconfirmed premise is how a whole epic gets redone.

## Questions to answer

1. With **no** `KSAIL_COPILOT_TOKEN` / `COPILOT_TOKEN` set and the Copilot CLI authenticated, does
the SDK path in `pkg/cli/cmd/open/chat/client.go` reach a working session — including
`models.list`, which is the call the code comments single out as scope-sensitive?
2. Does that same delegation work from a **non-TTY** parent process (the desktop app and the local
web server both spawn the CLI without a terminal)? This is the load-bearing question for the two
token-only interfaces.
3. Can a **GitHub App** installation token, or an app-owned OAuth device flow, obtain Copilot access
at all — or is a user seat strictly required? Answer with a citation to GitHub's documented
behaviour, not inference.
4. If the Copilot CLI is **absent**, is a KSail-owned OAuth device flow worth owning, or is
"install the Copilot CLI" the better answer?

## Definition of done

A decision recorded on this issue — evidence, options, chosen path, and why — plus follow-up issues
filed for whatever it implies. **No delivery PR.** If Q2 comes back negative, that is the most
valuable outcome here: it reshapes the desktop and web children before they are written.

Start with pkg/cli/cmd/open/chat/client.go and inspect the SDK path and its models.list scope comment. Test with the Copilot CLI authenticated, without KSAIL_COPILOT_TOKEN or COPILOT_TOKEN, including from a non-TTY parent; consult GitHub documentation for App and device-flow entitlement behavior. Done means recording evidence, options, the chosen path, and follow-up issues.

Written by the indexing model from the issue text.