perf: exclude browser tools and reduce turns in smoke-copilot (#1625)

* perf: exclude browser tools and reduce turns in smoke-copilot

Implements recommendations from #1624:

1. Exclude 21 unused Playwright/browser tools via --excluded-tools
   in postprocess-smoke-workflows.ts (saves ~10,500 tokens/turn)

2. Remove redundant MCP verification call — pre-step already proves
   MCP connectivity, no need for agent to call list_pull_requests

3. Remove redundant bash echo test — bash functionality is already
   proven by the file write/read test in section 3

4. Drop repos toolset — only pull_requests tools are used, removing
   4 unused tool schemas (~2,400 tokens/turn)

Expected impact: 5→3 LLM turns, ~25-30% token reduction per run.

Closes #1624

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: address PR review feedback

- Restore MCP call in section 1 so the workflow actually tests
  GitHub MCP connectivity (not just CLI/API)
- Make --excluded-tools injection idempotent: strip any existing
  flag before re-injecting so updates to the excluded list are
  always applied correctly on re-runs

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: lpcox

.github/workflows/smoke-copilot.lock.yml

@@ -22,7 +22,7 @@ tools:
   bash:
     - "*"
   github:
-    toolsets: [repos, pull_requests]
+    toolsets: [pull_requests]
 safe-outputs:
   add-comment:
     hide-older-comments: true
@@ -100,7 +100,7 @@ post-steps:
 The following tests were already executed in a deterministic pre-agent step. Your job is to verify the results and produce the summary comment.
 
 ### 1. GitHub MCP Testing
-The last 2 merged pull requests have been fetched. Verify MCP connectivity by calling `github-list_pull_requests` for ${{ github.repository }} (limit 1, state merged) and confirm data is returned.
+Verify MCP connectivity by calling `github-list_pull_requests` for ${{ github.repository }} (limit 1, state merged). Confirm the result matches the pre-fetched data below.
 
 ### 2. GitHub.com Connectivity
 Pre-step result: HTTP ${{ steps.smoke-data.outputs.SMOKE_HTTP_CODE }} from github.com.
@@ -111,9 +111,6 @@ Pre-step wrote and read back: "${{ steps.smoke-data.outputs.SMOKE_FILE_CONTENT }
 File path: ${{ steps.smoke-data.outputs.SMOKE_FILE_PATH }}
 Verify by running `cat` on the file path using bash to confirm it exists.
 
-### 4. Bash Tool Testing
-Run a simple bash command (e.g., `echo "bash works"`) to verify the bash tool is functional.
-
 ## Pre-Fetched PR Data
 
 ```

.github/workflows/smoke-copilot.md

@@ -244,6 +244,37 @@ for (const workflowPath of workflowPaths) {
     console.log(`  Replaced ${imageTagMatches.length} --image-tag/--skip-pull with --build-local`);
   }
 
+  // Exclude unused Playwright/browser tools from Copilot CLI for smoke-copilot.
+  // The Copilot CLI includes 21 built-in browser_* tools when --allow-all-tools is set.
+  // These tools are never used in smoke-copilot but add ~10,500 tokens/turn of dead weight.
+  // We inject --excluded-tools after --allow-all-tools to suppress them.
+  const isCopilotSmoke = workflowPath.includes('smoke-copilot.lock.yml');
+  if (isCopilotSmoke) {
+    const excludedToolsFlag =
+      '--excluded-tools=browser_close,browser_resize,browser_console_messages,' +
+      'browser_handle_dialog,browser_evaluate,browser_file_upload,browser_fill_form,' +
+      'browser_press_key,browser_type,browser_navigate,browser_navigate_back,' +
+      'browser_network_requests,browser_run_code,browser_take_screenshot,' +
+      'browser_snapshot,browser_click,browser_drag,browser_hover,' +
+      'browser_select_option,browser_tabs,browser_wait_for';
+    // First, strip any existing --excluded-tools flag to make this idempotent
+    const existingExcludedRegex = / --excluded-tools=[^\s'"]*/g;
+    const existingMatches = content.match(existingExcludedRegex);
+    if (existingMatches) {
+      content = content.replace(existingExcludedRegex, '');
+      console.log(`  Removed ${existingMatches.length} existing --excluded-tools flag(s)`);
+    }
+    const allowAllToolsCount = (content.match(/--allow-all-tools/g) || []).length;
+    if (allowAllToolsCount > 0) {
+      content = content.replace(
+        /--allow-all-tools/g,
+        `--allow-all-tools ${excludedToolsFlag}`
+      );
+      modified = true;
+      console.log(`  Injected --excluded-tools (21 browser tools) in ${allowAllToolsCount} location(s)`);
+    }
+  }
+
   // Remove unused "Setup Scripts" step from update_cache_memory jobs.
   // The step downloads a private action but is never used in these jobs,
   // causing 401 Unauthorized failures when permissions: {} is set.