Desktop app 1.1.17:  COPILOT_ENTRA_AUTH_AUD  (EMU audience) breaks MCP Entra sign-in with  ENTRA_CONFIG 2002 - CLI on the same machine works

Describe the bug

Environment

The bug

Windows devices configured for GitHub Enterprise Managed Users carry a machine-scope variable:

COPILOT_ENTRA_AUTH_AUD = "some-value"
                     = "GitHub Enterprise Managed User (OIDC)"  (GitHub's tenant)

It exists for Copilot's own Entra to GitHub token exchange. Since the WAM/OneAuth MCP path landed (#4660), it also reaches MCP sign-in, pinning a cross-tenant audience while the authority is the customer's own tenant. OneAuth rejects the configuration before any network call:

Request session.mcp.oauth.login failed: Microsoft Entra sign-in for
https://<our-mcp-server>/mcp/ failed: ENTRA_CONFIG: the authenticator
rejected the configuration [code 2002, tag 7q6cl].
Set COPILOT_ENTRA_DISABLE_ONEAUTH=1 to sign in through the browser instead.

Three observations that isolate it to the OneAuth path

1. Clearing the variable for a single process fixes it, with no client or server change:

Remove-Item Env:\COPILOT_ENTRA_AUTH_AUD
Start-Process "$env:LOCALAPPDATA\Programs\GitHub Copilot\github.exe"

Sign-in then succeeds immediately.

2. The CLI works on the same machine with the machine-scope variable still set, consistent with the release note that machines without the broker library keep the browser flow.

3. macOS 1.1.17 works. That build contains no OneAuth strings at all, so the variable is never consumed.

Steps to reproduce

1. Windows machine with COPILOT_ENTRA_AUTH_AUD set machine-wide (any EMU-configured device).
2. Add an Entra-protected MCP server whose API lives in a different tenant.
3. Sign in from the MCP tab. Fails 100%.
4. Same server, same machine, via the CLI. Succeeds.

Expected behavior

MCP token acquisition ignores COPILOT_ENTRA_AUTH_AUD, and an ENTRA_CONFIG rejection falls back to the browser flow rather than failing hard.

Empieza comparando el runtime de CLI incluido en la aplicación de escritorio en resources/copilot-sdk/cliVersion.d.ts con el comportamiento de CLI de @github/copilot que funciona en Windows. Reproduce el inicio de sesión de MCP con COPILOT_ENTRA_AUTH_AUD establecido, después elimínalo y hazlo con COPILOT_ENTRA_DISABLE_ONEAUTH=1. Se considera terminado cuando el inicio de sesión de MCP ignora la audiencia de Copilot y recurre al navegador después de un rechazo de ENTRA_CONFIG.