[dependabot:release-train-updater] `@github/copilot-sdk` patch update ready — blocked by create_pull_request bug (3rd occurrence)

## Dependency Release Train — Prepared Fix Blocked by create_pull_request Bug

### Summary
A validated, ready-to-apply patch bump for `@github/copilot-sdk` (`1.0.11` -> `1.0.13`) could not be submitted as a PR because `create_pull_request` failed with `"No changes to commit - no commits found"`, despite the branch/commit/diff all being verified present before the call.

**Action:** Maintainer: manually apply the patch below (or re-run the dependency workflow) and open the PR by hand; no code review judgment is required, this is a routine patch bump.

### This is the 3rd confirmed occurrence of a repo-specific `create_pull_request` bug
Per prior run cache notes, this exact failure (`"No changes to commit - no commits found"` despite a verified non-empty commit/diff) has now happened **three times** for `githubnext/gh-aw-cao` specifically, always when the workspace root checkout *is* the target repo (self-target, as opposed to a separate `target/` checkout):
1. 2026-09-10 07:55 UTC run — undici override fix (41+/34- diff)
2. 2026-09-10 14:37 UTC run — astro patch bump (50+/11- diff)
3. This run (2026-09-10 ~15:34 UTC) — `@github/copilot-sdk` patch bump (88+/105- diff, this issue)

Three different diffs, three different branch names/commit SHAs, same exact error every time — this strongly indicates a bug in the `create_pull_request` safe-output implementation specific to this self-target workflow configuration, not an issue with any particular candidate's diff content or size. **Recommend investigating the `create_pull_request` safe-output tool/action for this repository's workflow configuration.**

### Prepared fix (ready to apply)

**Branch (local only, not pushed):** `dependabot-agent/copilot-sdk-patch-update-20260910153402`
**Commit:** `7b1b2e72`

```diff
--- a/package.json
+++ b/package.json
@@ -35,7 +35,7 @@
"dependencies": {
"@astrojs/markdown-remark": "7.3.0",
"@astrojs/starlight": "0.42.0",
- "@github/copilot-sdk": "1.0.11",
+ "@github/copilot-sdk": "1.0.13",
"astro": "7.3.1",
"astro-mermaid": "2.1.0",
"mermaid": "11.17.2",
```

`package-lock.json` needs a matching regeneration; run:
```bash
npm install --package-lock-only --registry=https://registry.npmjs.org/ --ignore-scripts
```

### Why this update
- `@github/copilot-sdk` is a dev-only, opt-in dependency used solely by `dashboard/local-server.mjs` (`npm run dashboard:local:copilot`) — not part of `docs:build`, CI, or any production runtime path.
- Version `1.0.12` was never published as stable (only `1.0.12-preview.0` / `1.0.12-unstable.0` exist on the registry), so `1.0.13` is the correct next stable version.

### Validation performed
- Diffed `dist/index.d.ts` / `dist/client.d.ts` between `1.0.11` and `1.0.13`: purely additive (new optional types/fields), no removed exports. `CopilotClient`, `RuntimeConnection`, `defineTool` (the three symbols imported by `dashboard/local-server.mjs`) are unchanged.
- `npm view` dependency diff: `1.0.13` drops its `@github/copilot` dependency in favor of bundled `@github/copilot-sdk--` optional packages — correctly reflected in the regenerated lockfile.
- `npm audit --package-lock-only --json` before/after: identical 5 findings (1 high, 4 moderate) — the pre-existing, known devDependency-only `undici`/`@actions/*` chain; unaffected by this change.
- Both `package.json`/`package-lock.json` confirmed valid JSON.
- `git diff origin/main HEAD --stat`: exactly 2 files changed (`package.json` +1/-1, `package-lock.json` +88/-105), matching expectations for this version's dependency restructuring.

### Remaining validation gap
- Could not run a full `npm ci` + live `dashboard:local:copilot` smoke test in this sandbox (no full-registry network access beyond `--package-lock-only`, no signed-in Copilot CLI session available). Recommend a manual smoke test before merge.

### Control Plane
- Correlation ID: 34495676307-999
- Central repo: githubnext/gh-aw-cao
- Run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34495676307

Smart-Dependabot-Merge-Candidate: yes

> Generated by [:dependabot: Dependabot / Release Trains](https://github.com/githubnext/gh-aw-cao/actions/runs/34495676307) · copilot · auto · 109.4 AIC · ⌖ 13.3 AIC · ⊞ 18K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fdependabot-release-train-updater%22&type=issues)
>

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

```
gh aw add githubnext/gh-aw-cao/.github/workflows/dependabot-release-train-updater.md@main
```

> - [x] expires on Sep 24, 2026, 3:37 PM UTC

Start with the self-target workflow configuration and the create_pull_request safe-output implementation, then compare the three reported failures and the prepared package.json/package-lock.json change. Reproduce the verified-branch failure if possible. Done means the tool submits a non-empty commit and diff successfully, with the dependency lockfile regenerated and the recommended manual smoke test completed.

Written by the indexing model from the issue text.