Add guard coverage for gh gist rename

[Copilot]

gh gist rename mutates a gist through POST /gists/{gist_id} but lacked a guard write classification and DIFC rule.

• Classification: Add canonical rename_gist to the CLI-only write inventory.
• DIFC: Apply user-private secrecy and user-scoped writer integrity, matching other gist writes.
• Coverage: Extend classification and labeling tests for the new operation.

tool_names::DELETE_GIST | tool_names::RENAME_GIST => {
    secrecy = private_user_label();
    baseline_scope = Cow::Borrowed(scope_names::USER);
    integrity = writer_integrity(scope_names::USER, ctx);
}

• Fixes [guard-coverage] Guard coverage gap: 1 operation from github-mcp-server / GitHub CLI not fully covered #14728

[lpcox]

@copilot merge main and resolve conflicts

[Copilot]

🟢 Approval recommended

The classification, DIFC policy, and tests consistently cover the new operation.

0 open findings

What changed in this PR

Adds guard coverage for the CLI-only gh gist rename mutation.

Changes:

• Classifies rename_gist as a CLI write.
• Applies user-private secrecy and writer integrity labels.
• Adds classification and labeling tests.

File	Description
tools.rs	Registers and tests the CLI write operation.
tool_rules.rs	Adds DIFC labels and coverage.
constants.rs	Defines and tests the canonical tool name.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

@copilot merge main and resolve conflicts

Merged main and resolved both conflicts, preserving the gist rename classification and labels. Merge commit: 67ad844.