ci: auto-close new-server PRs and triage new-server issues

[olaservo]

Description

Adds two automations that enforce the existing CONTRIBUTING.md policy that new server implementations belong in the MCP Server Registry, not this repo.

1. new-server-pr-check.yml — auto-close PRs adding new servers (deterministic, no AI)

• Triggers on pull_request_target (API-only, never checks out PR code).
• Detects added files that create a top-level directory under src/ that does not exist on the base branch (the existing-directory set is fetched dynamically, so the workflow never needs updating).
• Labels the PR new-server-submission, posts one comment pointing to the registry and quickstart, and closes it.
• Escape hatch: a maintainer removes the label and reopens; the workflow will not re-close while the label is absent. Complements the existing readme-pr-check.yml, which keeps handling README-only edits with its /i-promise-this-is-not-a-new-server flow.

2. issue-triage.md (+ compiled issue-triage.lock.yml) — agentic triage of new-server issues

• A GitHub Agentic Workflow (public preview), engine: copilot, compiled with gh aw compile --strict (v0.81.6).
• On issue opened/reopened, classifies whether the issue is a new-server request. Only on high confidence does it label new-server-request, comment with registry pointers, and close as not planned; on any doubt it takes no action.
• Write operations are restricted to the declared safe-outputs (one label, one comment, close-issue); the agent job itself is read-only.
• No PAT or secret needed: copilot-requests: write in the frontmatter bills inference to the org Copilot plan (changelog).

Motivation and Context

New-server PRs and issues keep arriving despite the policy. Today only README-only PRs get an automated response (comment, no close); PRs adding directories under src/ and issues requesting new servers require manual triage.

How Has This Been Tested?

• gh aw compile --strict passes with no warnings; lock file reviewed (triggers, read-only agent job, safe-outputs jobs).
• Detection predicate validated against real PRs: feat: add pith-skill context compression server optimized for Windows #4404 (adds src/pith/) is detected; fix: add zod as explicit dependency for servers that import it directly #4446 (dependency fix across existing servers) and fix(git): correct field misalignment in date-filtered git_log #4524 (git server fix) are not. README-only additions like Add thumbgate community server #4292 are correctly left to readme-pr-check.yml.

Types of changes

• New feature (non-breaking change which adds functionality)

Additional context

Maintainer follow-ups needed after merge:

1. Create the two labels: new-server-submission and new-server-request.
2. (Separate from this PR) Enable automatic Copilot code review for all PRs via a branch ruleset: Settings -> Rules -> Rulesets -> New branch ruleset -> target the default branch -> enable "Automatically request Copilot code review" (recommend "Run on each push" on, drafts off). See configure automatic review.
3. Agentic workflows require the org to have GitHub Agentic Workflows (public preview) enabled and Copilot billing available for copilot-requests: write.