e2e: scope copilot GitHub token to the copilot-cli agent only

The E2E workflows that run agents in a shared/single job were handing the copilot GitHub token to every agent. A third-party agent CLI (opencode, gemini-cli, cursor-cli, factoryai-droid, codex) would receive a usable GitHub token in its process environment — credentials it has no need for.

Fix, without reverting the single-matrix design:

• e2e.yml, e2e-checkpoint-store.yml: COPILOT_GITHUB_TOKEN is now set only for the copilot-cli matrix leg (matrix.agent == 'copilot-cli' && github.token || ''), in both the bootstrap and test steps.
• e2e-isolated.yml: same per-agent guard on the COPILOT_GITHUB_TOKEN secret (inputs.agent == 'copilot-cli' && secrets.COPILOT_GITHUB_TOKEN || '').
• e2e.yml, e2e-checkpoint-store.yml: checkout now runs with persist-credentials: false so the copilot-scoped GITHUB_TOKEN isn't left in .git/config for an agent process to read. (The job-level copilot-requests: write permission must stay — GitHub does not allow matrix expressions in permissions: — but the token is no longer reachable by non-copilot agents via env or disk.)

e2e-checkpoints-v2.yml already compartmentalizes copilot in its own copilot-cli-only job, so it needs no change.