feat(safe-outputs): allow model-selected PR reviewers

[Copilot]

Summary

create-pull-request could only use statically configured reviewers, preventing agents from selecting reviewers dynamically.

• Add model-facing reviewers support.
• Require explicit allow-agent-reviewers: true operator opt-in.
• Merge and case-insensitively deduplicate static and agent-selected reviewers.
• Reuse existing ADO identity resolution and reviewer APIs.

safe-outputs:
  create-pull-request:
    allow-agent-reviewers: true

Test plan

• Verify MCP schema exposes reviewers.
• Verify agent reviewers are rejected without opt-in.
• Verify configured and agent reviewers merge and deduplicate.
• Run cargo test --all-targets.

• Fixes [agent-issue]: Allow model-selected reviewers in create-pull-request #2090

[azure-pipelines]

Azure Pipelines:
2 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.