[nikolasd]

Copilot's TUI session now gets a real classify_surface predicate, closing the gap left when
Claude and Codex got theirs: a copilot first-run session shows a folder-trust dialog whose
selection defaults to "Yes", so an unattended Enter grants filesystem trust before a human ever
answers it -- the same hazard already closed for codex.

classify_copilot_surface recognizes the dialog by its own title ("Confirm folder trust", a new
CopilotFolderTrust gate kind) and recognizes the composer as ready by footer chrome ("open
sidebar") rather than anything in the status line. That distinction matters because the only
committed composer capture is unauthenticated -- its status line reads "Please use /login to sign
in to use Copilot" -- so a predicate keyed on that line would fail closed on every normal,
signed-in machine instead of the unconfigured one it is meant to catch. What actually makes keying
on the footer safe is that copilot's dialog replaces the footer rather than drawing over the
composer's own (verified directly against both captures); a gate that instead overlaid the
composer chrome while leaving it on screen would defeat this, and copilot's sign-in gate has never
been observed, so that remains a real, stated, checkable risk rather than a hidden assumption. A
dedicated test pins exactly which bytes the predicate keys on and confirms the status line plays
no part in the result. Both phrases are proven exclusive against every committed fixture, and the
fixture-driven park-and-escalate path (journal, escalate, resume or fail on exit) is proven end to
end against a real replayed capture of the dialog, mirroring the equivalent claude/codex proof from
the slice that built that path.

The copilot conformance harness's own fixture double never printed anything the new predicate
recognizes as ready -- the same shape codex's fake double hit when its own readiness poll stopped
accepting any output as proof of life. Fixed the same way: added the real footer chrome to the
double's banner.

The copilot conformance harness's own workaround for the untrusted-workspace case
(ensure_copilot_workspace_trusted, a preflight check reachable only from the live conformance
path, never wired into the production adapter) is retired now that the production adapter
recognizes the same condition directly; the harness exercises the real path instead, including the
JSONC trust-file parser that existed only to serve it. docs/compatibility.md records both:
Copilot's gate as covered rather than pending, with the measured worktree-trust-inheritance table,
and the erratum this closes.

The escalation question a recognized trust gate raises now also names the one-time step that
pre-empts it on every future run -- trusting the repository once with that vendor in its own
session, or adding an entry to its own config file, named explicitly (~/.claude.json,
~/.codex/config.toml, ~/.copilot/config.json) -- alongside the existing instruction to answer
it in the pane or cancel the run. This applies to all three trust-shaped gates; sign-in and
theme-selection gates are unchanged, since there is no config-file equivalent for them to point at.

Tests: the new predicate's positive/negative cases and its exclusivity proof; the fixture-driven
park-and-escalate proof against copilot's real dialog capture; the escalation question's new
sentence for a trust gate (naming the actual file) and its deliberate absence for a non-trust gate.
Fixed two tests that assumed copilot had no real predicate, which stopped being true here.

Copilot's own PromptReady predicate is still checked against only one unauthenticated capture; a
signed-in composer's exact rendering remains unmeasured and is a tracked follow-up, not a fixture
gap this PR is missing.

cargo fmt --all, cargo clippy --all-targets --all-features -D warnings, CREW_DISABLE_VENDOR_CLI=1 cargo test --workspace (69 test binaries, all passing), bun test, bun run typecheck, and bun run generate --check all verified clean.