Formal spec alignment for GitHub MCP access-control conformance docs and predicate mapping

[Copilot]

This updates the formal-spec artifacts for GitHub MCP access-control compliance so the documented model, coverage map, and execution instructions stay synchronized with the executable conformance suite. It also corrects a predicate label mismatch in the formal test commentary to match the defined P1–P6 ordering.

• Spec usage contract alignment

  • Replaced the generic “Running Compliance Tests” section with a focused Usage section in specs/github-mcp-access-control-compliance/README.md.
  • Usage now explicitly reflects the formal suite entrypoints and self-contained test-file contract.

• Predicate mapping consistency

  • Corrected the inline predicate reference in TestFormal_OmittedReposAllowAll from P1_RepoMatch to P2_RepoMatch in pkg/workflow/github_mcp_access_control_formal_test.go, matching the formal guard ordering (P1=ToolAllowed, P2=RepoMatch).

Example of the corrected predicate annotation:

func TestFormal_OmittedReposAllowAll(t *testing.T) {
	// P2_RepoMatch: omitted repos field means "no restriction" — all accessible repos are allowed (spec §4.4.1).
	...
}

• Fixes [formal-spec] github-mcp-access-control-compliance/README.md — Formal model & test suite — 2026-07-23 #47632