refactor(actions): type consolidated MCP tools

[SamMorrowDrums]

Summary

Add concrete typed inputs and method-specific output unions to actions_list, actions_get, actions_run_trigger, and get_job_logs, with structured outputs advertised only for the recognized 2026-07-28 capability protocol.

Why

Part of #3385, stacked directly on #3397 at 4db5f54f982aa7c99c73321e99892f07f5f6445b. Actions tools need honest output contracts without changing legacy payloads or validation messages.

What changed

• Typed workflow/run/job/artifact/usage responses, dispatch and run-operation responses, and content/URL/partial-error log variants. Arbitrary dispatch input echoes use json.RawMessage; runner billing maps retain their upstream typed values.
• Preserve legacy coercions, ignored parameters, method-specific error precedence, response text, IFC labels, and scope/security annotations. Sparse upstream objects use anyOf where method shapes overlap.
• Add real MCP wire tests across modern, legacy, empty, and literal unknown protocol versions, plus exact-parent golden comparisons, schema-negative checks, IFC and client-error precedence coverage, and typed snapshots.
• Fix the tightly coupled shared output capability gate so malformed tokens and unsupported future dates cannot gain capabilities through lexical comparison. Minimum-protocol tool availability rules are unchanged.

MCP impact

• No tool or API changes
• Tool schema or behavior changed
• New tool added
  Modern clients receive concrete output schemas and matching structured content. Legacy and unrecognized versions do not; descriptive input enum values remain documented rather than overriding legacy validation. As in the existing typed layers, SDK registration presents returned client-acquisition Go errors as IsError tool results with the same message; direct handler errors remain unchanged.

Prompts tested (tool changes only)

• Automated MCP calls with mocked GitHub APIs cover “List workflows/runs/jobs/artifacts for owner/repo,” “Get a workflow/run/job/usage or download URL,” “Dispatch/re-run/cancel a workflow or delete its logs,” and “Get a single job's logs or all failed-job logs.” Natural-language/live-token end-to-end prompts were not run.

Security / limits

• No security or limits impact
• Auth / permissions considered
• Data exposure, filtering, or token/size limits considered
  Existing read/write OAuth scopes, destructive annotations, repository-visibility IFC labels, log tail defaults, and content-window behavior are preserved. Public/private IFC labels and disabled-label behavior are tested. Unknown protocol versions no longer expose typed output capabilities.

Tool renaming

• I am renaming tools as part of this PR (e.g. a part of a consolidation effort)
  • I have added the new tool aliases in deprecated_tool_aliases.go
• I am not renaming tools as part of this PR

Note: if you're renaming tools, you must add the tool aliases. For more information on how to do so, please refer to the official docs.

Lint & tests

• Linted locally with ./script/lint
• Tested locally with ./script/test

Required final sequence, all passed in this order:

1. UPDATE_TOOLSNAPS=true go test ./... — passed all packages.
2. script/lint — passed, 0 issues.
3. script/test — passed the complete race suite (pkg/github: 191.485s).
4. script/generate-docs — passed.
5. git diff --check — passed.

Additional verification: focused Actions/shared-gate tests passed; ACTIONS_LEGACY_BASELINE=true go test -overlay <exact-parent-actions-overlay.json> ./pkg/github -run TestTypedActions -count=1 passed against the Actions handlers extracted from the exact parent SHA. Live PAT-dependent E2E tests were not run. GitHub CI remains to be confirmed after publication.

Docs

• Not needed
• Updated (README / docs / examples)
  Generated README Actions parameter documentation; other generated documentation files were unchanged.