Add issue event history to issue_read behind a feature flag

[louim]

Summary

Adds three methods to issue_read behind a new issue_events feature flag: get_events, get_timeline and get_event.

Why

Agents can read an issue's current state but not its history: who requested reviews, which labels changed, what the title used to be, which commits referenced it. This rebuilds @artemsaveliev's #211 on current main. #211 predates the go-sdk migration and the merge of the issue read tools into issue_read, so the methods now live in issue_read.

@SamMorrowDrums this grew larger than #211 because the repo changed a lot since. Happy to adjust anything.

Closes #211
Closes #985
Refs #984

What changed

• get_events lists the issue's events. get_timeline lists the timeline, which adds comments, commits, reviews and cross-references. get_event fetches one event by event_id and takes no issue_number.
• New output types MinimalIssueEvent and MinimalTimelineItem. Bodies, commit messages and the dismissal message use sanitize.Content. Titles use sanitize.PlainText. This matches get_comments and get.
• IssueRead and IssueReadWithEvents are two variants of the tool, and the flag picks one. This follows the pattern from Expose Copilot review thread resolution reasons #3123.

MCP impact

• Tool schema or behavior changed

The schema changes only with the flag on. Without it, issue_read.snap is unchanged and the handler returns "unknown method" for the three new methods.

Prompts tested (tool changes only)

Run against the live API on github/github-mcp-server, cli/cli, golang/go and a private repo.

• "Who was asked to review this PR, and did anyone review it without being asked?" (get_timeline)
• "What's the event history of this issue?" (get_events)
• "What happened on this pull request?" (get_timeline, including cross-repo references)
• "Look up issue event 17200362448." (get_event)

Also tested: pagination, renamed, milestone, lock_reason, requested_team versus requested_reviewer, and the lockdown paths below.

Security / limits

• Auth / permissions considered
• Data exposure, filtering, or token/size limits considered

Lockdown follows the existing rules. get_events and get_timeline drop entries whose author lacks push access, and get_event returns an error, as issue_read:get does. I checked this against the existing get_comments path. commented and reviewed entries name their author in User instead of Actor, so both are checked. committed entries carry only a commit name and email, so lockdown drops them.

The flag is there because of size: the timeline of #211 (71 entries) is 172KB raw and 27KB trimmed.

Open question for a maintainer: go-github's Timeline type has no minimized field, so a comment hidden as spam or abuse looks like any other comment. The type also lacks html_url, author_association, updated_at, reactions and lock_reason, so get_timeline shows less about a comment than get_comments does.

Tool renaming

• I am not renaming tools as part of this PR

Lint & tests

• Linted locally with ./script/lint (0 issues)
• Tested locally with ./script/test (clean, including -race)

script/generate-docs produces no changes. The only new toolsnap is issue_read_ff_issue_events.snap.

Docs

• Updated (README / docs / examples)

🤖 Generated with Claude Code

[louim]

@SamMorrowDrums gentle ping here. Would love to get this in!

[dawNotPoi]

I found a Markdown fidelity regression in the new timeline converter; details inline.

[louim]

@SamMorrowDrums this has been re-aligned with the main branch changes.