AHP: opt into SDK managed-settings self-fetch

Pass selfFetchManagedSettings:true in session.create params so the
runtime self-fetches enterprise bypass-permissions policy from the
GitHub managed_settings endpoint at session bootstrap. The runtime
enforces the result fail-closed before the first turn.

Requires: github/copilot-agent-runtime#agents/managed-settings-sdk-capability

Author: joshspicer

src/vs/platform/agentHost/node/copilot/copilotSessionLauncher.ts

@@ -58,6 +58,13 @@ type PostToolUseHookInput = Parameters<NonNullable<SessionHooks['onPostToolUse']
 type CopilotSessionLaunchConfig = ResumeSessionConfig & {
 	readonly pluginDirectories?: string[];
 	readonly remoteSession?: 'export';
+	/**
+	 * Opt the runtime into self-fetching enterprise managed settings at session
+	 * bootstrap. Declared locally until the published `@github/copilot-sdk` carries
+	 * it on `SessionConfigBase`; it is forwarded to `createSession` and read by the
+	 * runtime at runtime regardless of the published SDK's static type.
+	 */
+	readonly selfFetchManagedSettings?: boolean;
 };
 
 /**
@@ -410,6 +417,12 @@ export class CopilotSessionLauncher implements ICopilotSessionLauncher {
 			// session must opt in via `remoteSession` to actually export
 			// events. Without this, sessions default to "off".
 			remoteSession: this._configurationService.getRootValue(platformRootSchema, AgentHostSessionSyncEnabledConfigKey) === true ? 'export' : undefined,
+			// Opt the runtime into self-fetching enterprise managed settings
+			// (bypass-permissions policy) at session bootstrap. The runtime uses
+			// the session's gitHubToken to call /copilot_internal/managed_settings
+			// and enforces the result fail-closed before the first turn.
+			// Typed locally on CopilotSessionLaunchConfig pending the SDK type update.
+			selfFetchManagedSettings: true,
 		};
 	}
 }