The GitHub guard was missing explicit coverage for the upstream issue dependency capability, leaving one mutating tool unclassified and two issue-dependency tools without dedicated DIFC rule handling. This PR closes that gap by aligning classification and label application with existing issue-scoped behavior.

• Tool classification (tools.rs)

  • Added issue_dependency_write to READ_WRITE_OPERATIONS so mutating dependency updates are treated as read-write operations.

• DIFC rule coverage (tool_rules.rs)

  • Added explicit apply_tool_labels arms for:
    • issue_dependency_read: repo-visibility secrecy + issue-scoped description + private-repo baseline integrity behavior consistent with issue reads.
    • issue_dependency_write: repo-visibility secrecy + issue-scoped description + writer_integrity(repo) for dependency mutations.

• Guard regression tests

  • Added focused tests to assert:
    • issue_dependency_write is classified as read-write (and not write-only).
    • issue_dependency_read label output matches issue_read for equivalent inputs.
    • issue_dependency_write produces writer integrity and expected issue description formatting.

"issue_dependency_write" => {
    if !owner.is_empty() && !repo.is_empty() {
        if let Some(issue_num) = extract_number_as_string(tool_args, field_names::ISSUE_NUMBER) {
            desc = format!("issue:{}/{}#{}", owner, repo, issue_num);
        }
    }
    secrecy = apply_repo_visibility_secrecy(&owner, &repo, repo_id, secrecy, ctx);
    integrity = writer_integrity(repo_id, ctx);
}