fix(deps): bump Copilot SDK to 1.0.11 with compatible MAF adapter

[sabbour]

Supersedes #876, which bumped GitHub.Copilot.SDK 1.0.2 → 1.0.11 on its own and failed CI with five CS0012 errors in Agentweaver.AgentRuntime.

Root cause

The failure is not assembly-version drift. GitHub.Copilot.SDK became strong-named in 1.0.4:

SDK version	Assembly identity
1.0.2	Version=1.0.2.0, PublicKeyToken=null
1.0.3	Version=1.0.3.0, PublicKeyToken=null
1.0.4	Version=1.0.4.0, PublicKeyToken=cc7b13ffcd2ddd51
1.0.11	Version=1.0.11.0, PublicKeyToken=cc7b13ffcd2ddd51

Microsoft.Agents.AI.GitHub.Copilot 1.11.1-rc1 was compiled against the unsigned SDK — its metadata records GitHub.Copilot.SDK, Version=1.0.0.0, PublicKeyToken=null plus a TypeRef to GitHub.Copilot.CopilotClient. Roslyn tolerates version drift for weakly-named references (CS1701/CS1702 are in this build's /nowarn list), which is why a 1.0.0.0 reference happily binds to 1.0.2.0. A null-public-key reference can never bind to a strong-named definition, so the type becomes unreachable and the compiler reports CS0012. The SDK is present on the csc /reference list — this is an identity-unification refusal, not a missing reference.

Bisecting confirms the boundary is signing, not version:

SDK 1.0.2  -> PASS      SDK 1.0.5  -> FAIL CS0012
SDK 1.0.3  -> PASS      SDK 1.0.6..1.0.9 -> FAIL CS0012
SDK 1.0.4  -> FAIL      SDK 1.0.11 -> FAIL CS0012

Fix

Bump the adapter alongside the SDK. Adapter → SDK build matrix:

Microsoft.Agents.AI.GitHub.Copilot	nuspec dep	Assembly ref
1.11.1-rc1 … 1.13.0-rc1	1.0.0	v1.0.0.0, PKT=null
1.14.0-rc1 … 1.19.0	1.0.5	v1.0.5.0, PKT=cc7b13ffcd2ddd51

This PR moves to 1.19.0 — the latest stable, which also gets the package off an -rc1 prerelease.

Why no source changes are needed

• The adapter's public type surface is identical between 1.11.1-rc1 and 1.19.0 (3 of 3 types unchanged, none added or removed).
• The only breaking member change is GitHubCopilotAgent's constructor (7 → 9 params). The repo never constructs it directly — every new GitHubCopilotAgent… hit is Agentweaver's own GitHubCopilotAgentRunner, and GitHubCopilotClientFactory is defined in Agentweaver.AgentRuntime.
• Microsoft.Agents.AI.Abstractions moves 1.11.1 → 1.19.0 but keeps the same public key (f300afd708cefcd3), so Microsoft.Agents.AI.Workflows 1.11.1 unifies normally. Workflows and A2A are deliberately left untouched to keep the change minimal.

Lock files

The resolution delta is exactly three packages — GitHub.Copilot.SDK, Microsoft.Agents.AI.GitHub.Copilot, Microsoft.Agents.AI.Abstractions — plus the agentweaver.agentruntime project entry. Nothing else in any graph shifts.

Verification

• dotnet restore --locked-mode on Agentweaver.AgentRuntime succeeds → lock file is internally consistent.
• dotnet build Agentweaver.AgentRuntime → Build succeeded, 0 errors, 0 warnings. The five CS0012 errors are gone.
• The regenerated GitHub.Copilot.SDK 1.0.11 contentHash matches dependabot's nuget.org-generated value in chore(deps): Bump GitHub.Copilot.SDK from 1.0.2 to 1.0.11 #876 byte-for-byte.

Note for reviewers: Agentweaver.Api and Agentweaver.Tests could not be built locally. This machine restores through an approved NuGet proxy that tops out at OpenTelemetry.* 1.17.0 while the repo pins 1.18.0 — unmodified dev fails locked-mode restore identically, so this is a pre-existing environment gap, not a regression from this PR. Those two projects are covered by CI here.

Follow-up

Once this merges, consider a Dependabot ignore guard is not needed any more — the adapter now tracks the signed SDK line, so future GitHub.Copilot.SDK patch bumps should resolve cleanly on their own. #876 can be closed.