feat(llm-security-copilot): port llm-security v5.1.0 to GitHub Copilot CLI

Full port of llm-security plugin for internal use on Windows with GitHub
Copilot CLI. Protocol translation layer (copilot-hook-runner.mjs)
normalizes Copilot camelCase I/O to Claude Code snake_case format — all
original hook scripts run unmodified.

- 8 hooks with protocol translation (stdin/stdout/exit code)
- 18 SKILL.md skills (Agent Skills Open Standard)
- 6 .agent.md agent definitions
- 20 scanners + 14 scanner lib modules (unchanged)
- 14 knowledge files (unchanged)
- 39 test files including copilot-port-verify.mjs (17 tests)
- Windows-ready: node:path, os.tmpdir(), process.execPath, no bash

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

plugins/llm-security-copilot/tests/hooks/hook-helper.mjs

@@ -0,0 +1,42 @@
+// hook-helper.mjs — Shared test helper for hook scripts.
+// Spawns a hook as a child process and feeds it JSON via stdin.
+
+import { execFile } from 'node:child_process';
+
+/**
+ * Run a hook script by spawning `node <scriptPath>` and piping `input` to stdin.
+ *
+ * @param {string} scriptPath - Absolute path to the hook .mjs file
+ * @param {object|string} input - JSON payload (object will be stringified)
+ * @returns {Promise<{ code: number, stdout: string, stderr: string }>}
+ */
+export function runHook(scriptPath, input) {
+  return runHookWithEnv(scriptPath, input, {});
+}
+
+/**
+ * Run a hook script with custom environment variables.
+ *
+ * @param {string} scriptPath - Absolute path to the hook .mjs file
+ * @param {object|string} input - JSON payload (object will be stringified)
+ * @param {Record<string, string>} envOverrides - Extra env vars to set
+ * @returns {Promise<{ code: number, stdout: string, stderr: string }>}
+ */
+export function runHookWithEnv(scriptPath, input, envOverrides) {
+  return new Promise((resolve) => {
+    const env = { ...process.env, ...envOverrides };
+    const child = execFile(
+      'node',
+      [scriptPath],
+      { timeout: 5000, env },
+      (err, stdout, stderr) => {
+        resolve({
+          code: child.exitCode ?? (err && err.code === 'ERR_CHILD_PROCESS_STDIO_FINAL' ? 0 : 1),
+          stdout: stdout || '',
+          stderr: stderr || '',
+        });
+      }
+    );
+    child.stdin.end(typeof input === 'string' ? input : JSON.stringify(input));
+  });
+}