[Code Quality] Clarify COPILOT_GITHUB_TOKEN vs GITHUB_TOKEN distinction in Quick Start docs

[github-actions]

Description

The Quick Start documentation references COPILOT_GITHUB_TOKEN (a separate Personal Access Token) but does not explain why it differs from the default GITHUB_TOKEN. New users are left confused about the security architecture.

From the Documentation Noob Tester Report — 2026-07-18:

"This is a non-obvious security architecture decision. A beginner will wonder: Why can't I just use my existing GitHub token?"

Suggested Changes

• In the Quick Start or CLI setup page, add a one-sentence callout near the COPILOT_GITHUB_TOKEN setup section:

  "This is separate from the default GITHUB_TOKEN because the agent needs elevated Copilot API access that the ephemeral workflow token does not carry."

• Consider a callout box linking to the security section.

Files Affected

• docs/src/content/docs/setup/quick-start.md — PAT setup section
• docs/src/content/docs/setup/cli.md — prerequisite AI engine section

Success Criteria

• A first-time user understands why a separate token is needed without reading extra docs.
• Explanation fits in 1–2 sentences, no new jargon.
• Documentation build passes.

Source

Extracted from Documentation Noob Test Report — 2026-07-18 #46338

Priority

Medium — reduces user confusion at the very first setup step; documentation-only change.

🔍 Task mining by Discussion Task Miner - Code Quality Improvement Agent · 308.6 AIC · ⌖ 5.31 AIC · ⊞ 7K · ◷

• expires on Jul 19, 2026, 5:31 PM UTC-08:00