[Bug] GHE.com data residency: built-in PR/issue tools send unauthenticated requests to api.<tenant>.ghe.com (401/403), agent must fall back to gh CLI

### Short summary
Built-in PR/issue features send unauthenticated API requests to GHE.com (data residency) host, causing 401/403

### Affected version or release
1.1.6 (commit a9706b2)

### Installation context
Windows 11 x64. Signed in with a single GHE.com data-residency account (`9altitudes.ghe.com`), which also holds the Copilot subscription. A secondary github.com account is added but has no Copilot license.

### What happened?
The app resolves the correct GHE.com host for its internal PR/issue tooling, but several internal API calls go out **without credentials**, so they fail with 401/403 anonymous-request errors:

- `create_pull_request` tool:
```
github_app::tools::create_pull_request: Project account repair candidate could not inspect repository for PR creation
login=FlemmingBK host=9altitudes.ghe.com
error=github API request failed (401): Must authenticate to access this API.
```
- PR auto-link loop (`github_api_external_created_pr_lookup`) repeatedly fails:
```
url=https://api.9altitudes.ghe.com/repositories//pulls
status=403 error=github API rate limited (403): API rate limit exceeded for .
(But here's the good news: Authenticated requests get a higher rate limit...)
```
The "rate limit exceeded for " wording confirms the request was anonymous.

Replaying the exact same URL (`https://api.9altitudes.ghe.com/repositories/`) with the OAuth token the app itself provisioned (the one it injects as `GH_TOKEN` for sessions) succeeds — so the token is valid and has access; the app just does not attach it for these calls.

Net effect: built-in create-PR/issue features fail and the agent must fall back to the `gh` CLI, which works because `GH_HOST`/`GH_TOKEN` are injected correctly.

Request IDs (from `github-app..log`):
- 403 anonymous: `F874:EE0A5:C31A1:6D5050:6A787AE1` (2026-08-09 13:04:33 UTC)
- 401 create_pull_request: `D0D6:9A8F9:25D76F:AAAC03:6A75EF50`

### Steps to reproduce
1. Sign in to the Copilot app with a GHE.com data-residency account only (Copilot subscription on that account).
2. Open a project session on a repo hosted on the GHE.com tenant, make a change.
3. Use the built-in create pull request flow (or let the app try to auto-link an externally created PR).
4. Observe 401/403 failures in `~/.copilot/logs/github-app..log` against `api..ghe.com`, and the agent falling back to `gh`.

### Expected behavior
Internal API calls to `api..ghe.com` should carry the same OAuth credentials the app already holds for that host, so built-in PR/issue tooling works on GHE.com the same as on github.com.

### Additional context
- `gh auth status` inside sessions is correct (`GH_HOST=9altitudes.ghe.com`, valid token) — only the app's own internal client is affected.
- Possibly related but distinct: #1441 (ghe.com sign-in), #1131 (OAuth scope on GHEC data residency), #2027 (links open github.com).

Empieza por las rutas create_pull_request y github_api_external_created_pr_lookup, usando github-app logs para rastrear las solicitudes enviadas a api..ghe.com. Compara esas solicitudes internas con el comportamiento autenticado de GH_HOST/GH_TOKEN de la CLI gh; se considera terminado cuando las herramientas integradas de PR e issues envían las credenciales OAuth disponibles y dejan de producir respuestas anónimas 401/403.

Escrito por el modelo de indexación a partir del texto del issue.