Respect preferred GitHub account across authentication scopes

[Copilot]

Account switching could retain credentials from another GitHub identity when accounts had different scope-specific sessions, exposing stale private PRs and causing unauthorized actions under the wrong account.

• Session selection
  • Resolve VS Code’s preferred account across all scopes.
  • Select the richest available session constrained to that account.
  • Preserve legacy fallback when no preference is available.

const preferred = await getSession(provider, [], { silent: true });
await getSession(provider, scopes, {
  silent: true,
  account: preferred.account,
});

• Regression coverage
  • Cover accounts with different default and additional scope sets.
  • Verify broader scopes never override the preferred account.

• Fixes Multiple accounts doesn't work for any but the first account added #8789

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Alex Ross (alexr00)]

Copilot Can you explain why this happens? As far as I can see we're always asking for a specific auth provider id already. Are you saying that getSession can return a session with a different auth provider ID than we ask for?

[Copilot]

Copilot Can you explain why this happens? As far as I can see we're always asking for a specific auth provider id already. Are you saying that getSession can return a session with a different auth ...

No—the provider ID remains github. That provider can have sessions for multiple accounts, and each account can have different exact scope sets. VS Code filters by provider and requested scopes before applying the extension’s account preference. If preferred Account B has no session for those scopes but Account A is the only matching allowed session, silent getSession('github', scopes, ...) returns A. We then incorrectly treated A as the preferred account. The empty-scope lookup includes all scope-specific sessions so VS Code can select B first; subsequent lookups pass account: B. The EMU error in the screenshot is consistent with using the wrong account/token within the same github provider, not a different provider ID.