Suggested test: copilot/mcp-http-oidc-permission-enforcement

## Motivation

github/gh-aw#50054 — enforces `permissions.id-token: write` when any HTTP MCP server uses `auth.type: github-oidc`, and hardens the AWF exclude-env list (`ACTIONS_ID_TOKEN_REQUEST_URL`/`TOKEN`) so OIDC credentials stay out of the agent process, forwarded only runner→gateway.

## Proposed test

- **Workflow file**: `test-copilot-mcp-http-oidc-permission.md`
- **Trigger**: `workflow_dispatch`
- **Engine**: copilot
- **Safe output**: `create-issue` (report pass/fail of the OIDC-gated MCP call)
- **Variant**: standard

## Minimal test prompt sketch

Configure an HTTP MCP server with `auth.type: github-oidc` but omit `permissions.id-token: write`, and confirm `gh aw compile` rejects the workflow with the expected error. Optionally add a second positive-path variant with the permission present that compiles successfully and the agent reports success via a noop/issue.

## New fixtures or secrets needed

None for the compile-time negative-path check. A working HTTP MCP server with OIDC auth would be needed for the positive runtime path — if none exists in `shared/mcp/`, the positive-path test may need to be scoped down to compile-only assertion.

## Notes

This is primarily a compiler validation change (permission enforcement), so most value comes from asserting `gh aw compile` fails as expected when the permission is missing — this may fit better as a unit-style check outside the live-engine E2E harness. Flagging as an issue rather than a PR because it's unclear whether `e2e.sh` currently has infrastructure for asserting *expected compile failures* vs. runtime successes. Not present in `existing-tests.json` or `open-suggestions.json`.

> Generated by [🔍 Suggest New E2E Tests](https://github.com/githubnext/gh-aw-test/actions/runs/30896082598) · auto · 36.6 AIC · ⌖ 3.13 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-test+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-test%2Fsuggest-new-e2e-tests%22&type=issues)

Start by reading e2e.sh and the existing test definitions, especially existing-tests.json and open-suggestions.json, to see how workflow_dispatch tests and compile results are represented. Add test-copilot-mcp-http-oidc-permission.md if the harness supports the proposed shape, and verify that gh aw compile rejects the missing permission; scope any positive path only if shared/mcp/ provides a suitable OIDC server.

Written by the indexing model from the issue text.