[deps-release-notes] copilot-cli v1.0.52 action items

## Release Notes Action Items for `copilot-cli` `1.0.48` → `1.0.52`

This issue summarizes upstream release notes for the `copilot-cli` dependency between the previously pinned version (`1.0.48`) and the new pinned version (`1.0.52`), highlighting items that may need follow-up in ado-aw.

The companion version-bump PR is titled `chore(deps): update COPILOT_CLI_VERSION to 1.0.52`.

### Releases analyzed

- [v1.0.51](https://github.com/github/copilot-cli/releases/tag/v1.0.51)
- [v1.0.52](https://github.com/github/copilot-cli/releases/tag/v1.0.52)

### Security fixes

- **Secret scanning covers commit messages and PR descriptions** ([v1.0.51](https://github.com/github/copilot-cli/releases/tag/v1.0.51)): "Secret scanning now covers commit messages and PR descriptions, redacting secrets before they are published." ado-aw creates commits and PRs through its safe-output tools; this change means the copilot agent running in stage 1 will automatically redact secrets from any content it writes into those fields. Maintainers should verify that the ado-aw detection stage still correctly handles redacted content and that safe-output fields like PR descriptions are not inadvertently affected.

### Notable features for ado-aw to adopt

- **`deferred-tool-loading` in agent frontmatter** ([v1.0.52](https://github.com/github/copilot-cli/releases/tag/v1.0.52)): "Custom agents support opt-in deferred tool loading via `deferred-tool-loading` in agent frontmatter, enabling tool-search discovery for agents with large tool lists." ado-aw could expose this as a new optional field in its agent frontmatter schema (e.g. under the `engine:` section) so authors of agents with large tool sets can opt in.
- **`--session-id=` for session resumption** ([v1.0.51](https://github.com/github/copilot-cli/releases/tag/v1.0.51)): "--session-id=(id) resumes known sessions or tasks, and starts new sessions with a specific UUID." ado-aw could wire this into pipeline parameters to allow deterministic session IDs across retries or follow-up pipeline runs.
- **`postToolUse` hooks can inject `additionalContext`** ([v1.0.51](https://github.com/github/copilot-cli/releases/tag/v1.0.51)): "postToolUse hooks can now inject additionalContext into successful tool results." ado-aw's `ado-script` extension or future hook infrastructure may want to leverage this to inject context after safe-output tool calls.
- **`preMcpToolCall` hook for MCP request metadata** ([v1.0.51](https://github.com/github/copilot-cli/releases/tag/v1.0.51)): "Add preMcpToolCall hook for hook providers to control outgoing MCP request metadata." Relevant to ado-aw's MCP server and MCPG integration.
- **Legacy nested MCP OAuth config keys auto-migrated** ([v1.0.52](https://github.com/github/copilot-cli/releases/tag/v1.0.52)): "Legacy nested `oauth.clientId` and `oauth.callbackPort` keys in MCP server configs are now migrated to the supported `oauthClientId` and `auth.redirectPort` keys instead of being silently dropped." ado-aw's MCP config generation in `src/mcp.rs` and MCP extensions should ensure they emit `oauthClientId`/`auth.redirectPort` rather than deprecated nested forms.
- **GitHub MCP web search available immediately without tool search** ([v1.0.51](https://github.com/github/copilot-cli/releases/tag/v1.0.51)): "GitHub MCP web search tool is available immediately without requiring tool search." ado-aw agent docs and the `github` extension should note that this tool is always available OOTB.

---
*This issue was opened automatically by the dependency version updater workflow.*

> Generated by [Dependency Version Updater](https://github.com/githubnext/ado-aw/actions/runs/26355945767) · ● 12.4M · [◷](https://github.com/search?q=repo%3Agithubnext%2Fado-aw+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fado-aw%2Fupdate-awf-version%22&type=issues)