GH-300 decision sheets

• Content exclusion: what it protects and what still leaks
• Copilot CLI: platforms, install methods and session commands
• Copilot safeguards: human-centred controls vs technical mitigations