fix(copilot): support GitHub Enterprise endpoints

[adamkrawczyk]

Summary

• Route Copilot OAuth, GitHub CLI token lookup, and token exchange through COPILOT_GH_HOST.
• Route inference, model discovery, credential refresh, and auxiliary clients through explicit or exchange-discovered enterprise endpoints.
• Centralize Copilot endpoint classification while preserving all public GitHub defaults.
• Document the enterprise configuration variables and cover the behavior with regression tests.

Closes #11442.

Prior work

This builds on the GitHub Enterprise support proposed by @HearthCore in #6468 and adapts it to the current provider, credential-pool, model-catalog, Responses API, and auxiliary-client architecture.

Configuration

COPILOT_GH_HOST=ghe.example.com
COPILOT_API_BASE_URL=https://copilot-api.ghe.example.com

COPILOT_GH_HOST controls OAuth, gh auth token --hostname, and token exchange. COPILOT_API_BASE_URL is authoritative for inference and model-catalog routing. When unset, token-exchange endpoint metadata is used before the public fallback.

Test plan

• Added regression coverage for enterprise OAuth, token exchange, endpoint precedence, catalog routing, refresh behavior, Responses mode, auxiliary clients, and Copilot headers.
• Ran the affected test set: 504 passed.
• Ran Ruff on all changed Python files.
• Verified an end-to-end request against a GitHub Enterprise Copilot deployment.

Risk assessment

Low. Public GitHub URLs remain the defaults when enterprise variables are unset. Endpoint matching uses parsed hostnames rather than substring matching, and catalog caches include endpoint identity to avoid cross-account reuse.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[arminanton]

This is valuable — enterprise-endpoint support has been a real gap. One data point from running a plan-scoped (business) account that might help harden the resolver:

The token-exchange discovery path (POST /copilot_internal/v2/token → endpoints.api) returns 403 Forbidden on some accounts, even where Copilot itself works fine. On those same accounts GET /copilot_internal/user returns 200 and carries both copilot_plan and endpoints.api (business → api.business.githubcopilot.com, enterprise → api.enterprise.githubcopilot.com). This looks like the same class as #30624 (picker falls back to a stale list when the token exchange fails but /models is reachable).

Suggestion: try the exchange first (your current path, correct for enterprise-exchange accounts), then fall back to /copilot_internal/user when the exchange 403s — that covers both account shapes. Happy to share the exact resolver shape if useful. Also worth noting one endpoint that must stay pinned: the auto-mode session control-plane (/models/session, /models/session/intent) returns 421 Misdirected Request on the business host, so those specific calls need to stay on api.githubcopilot.com even when inference is routed to the plan host.