Add ifc label for get_me tool

[JoannaaKL]

Summary

Adds minimal IFC security label annotations to get_me tool output behind --insiders flag.

What changed

• Replaced pkg/ifc/ lattice implementation with a lightweight SecurityLabel struct using Integrity and Confidentiality enums — annotation only, no lattice algebra. The enforcement engine lives in a separate service.
• get_me sets result.Meta["ifc"] with {"integrity":"trusted","confidentiality":["public"]} when insiders mode is enabled.
• Updated script/get-me to reliably capture and display the label.

{
   "_meta": {
    "ifc": {
      "integrity": "trusted",
      "confidentiality": [
        "public"
      ]
    }
  },
  "content": {
    "login": "JoannaaKL",
    "id": 67866556,
    "profile_url": "https://github.com/JoannaaKL",
    "avatar_url": "https://avatars.githubusercontent.com/u/67866556?v=4",
    "details": {
      "name": "JoannaaKL",
      "company": "GitHub",
    }
  }
}

MCP impact

• Tool schema or behavior changed
  • get_me result includes _meta.ifc in insiders mode only. No change to stable behavior.

Security / limits

• No security or limits impact

Tool renaming

• I am not renaming tools as part of this PR

Lint & tests

• Linted locally with ./script/lint
• Tested locally with ./script/test

Docs

• Not needed

[Copilot]

Pull request overview

This PR adds an IFC (Information Flow Control) label to the get_me tool’s call result metadata when InsidersMode is enabled, backed by a new pkg/ifc package implementing lattice structures and reader-based confidentiality labels.

Changes:

• Introduces a new pkg/ifc package with core lattice types, inverse lattice support, and a reader-set powerset lattice used to construct IFC labels.
• Adds a LabelGetMe() helper that returns a “public + trusted” readers-based security label.
• Updates get_me to include the IFC label in CallToolResult.Meta in insiders mode, and adds a focused test to validate meta behavior.

Show a summary per file

File	Description
pkg/ifc/readers_lattice.go	Adds reader-set powerset lattice and ReadersSecurityLabel (incl. JSON serialization) for reader-based confidentiality.
pkg/ifc/lattice.go	Adds generic lattice interfaces and basic confidentiality/integrity lattice implementations plus product/inverse lattice helpers.
pkg/ifc/labelling_engine_readers.go	Adds LabelGetMe() helper for the get_me tool’s IFC label.
pkg/github/context_tools.go	Conditionally attaches the IFC label to get_me call result metadata when insiders mode is enabled.
pkg/github/context_tools_test.go	Adds tests asserting get_me includes/omits IFC meta depending on insiders mode.

Copilot's findings

• Files reviewed: 5/5 changed files
• Comments generated: 7

[gokhanarkan]

Some comments to make sure we align on the spec!