Forward selfFetchManagedSettings in session.create wire call

Add selfFetchManagedSettings to SessionConfigBase and forward it in the
session.create RPC payload. This allows hosts (e.g. VS Code AHP) to opt
the runtime into enterprise managed-settings self-fetch and enforcement.

Without this change, the field is silently dropped by the explicit field
list in client.ts and never reaches the runtime.

Requires: github/copilot-agent-runtime#agents/managed-settings-sdk-capability

Author: joshspicer

nodejs/src/client.ts

@@ -1448,6 +1448,7 @@ export class CopilotClient {
                 remoteSession: config.remoteSession,
                 cloud: config.cloud,
                 expAssignments: config.expAssignments,
+                selfFetchManagedSettings: config.selfFetchManagedSettings,
             });
 
             const {
@@ -1646,6 +1647,7 @@ export class CopilotClient {
                 remoteSession: config.remoteSession,
                 openCanvases: config.openCanvases,
                 expAssignments: config.expAssignments,
+                selfFetchManagedSettings: config.selfFetchManagedSettings,
             });
 
             const { workspacePath, capabilities, openCanvases } = response as {

nodejs/src/types.ts

@@ -2072,6 +2072,14 @@ export interface SessionConfigBase {
      */
     gitHubToken?: string;
 
+    /**
+     * Opt-in: when true, the runtime self-fetches enterprise managed settings
+     * (bypass-permissions policy) at session bootstrap using the session's
+     * `gitHubToken`. The runtime calls `/copilot_internal/managed_settings`
+     * and enforces the result fail-closed before the first turn.
+     */
+    selfFetchManagedSettings?: boolean;
+
     /**
      * When true, skips embedding-based retrieval for this session.
      * Use in multitenant deployments to prevent cross-session information leakage