Merge pull request #14815 from cli/babakks/auth-status-expired-hint

fix(gh auth status): explain expired expiring tokens with `--no-refresh`

Merge pull request #14805 from cli/bagtoad/attach-with-installation-t…

…okens

Defer `--attach` credential checks to the server

Merge pull request #14798 from cli/babakks/polish-auth-login-expiring-ux

feat(gh auth login): hint at `--expiring` when no preference is set

Merge pull request #14782 from cli/babakks/skill-gh-expiring-tokens

Document expiring tokens in the gh skill

Bump golang.org/x/net to v0.60.0

Fixes GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612 and
GO-2026-6617 reported by govulncheck.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
(cherry picked from commit 31778eb)
Copilot-Session: 628f83e8-2009-4ff8-bc0f-4eb8c47b0a7f

Merge commit from fork

Harden filesystem writes against symlinks

Merge pull request #14462 from cli/revert-14437-williammartin-apple-c…

…odesign-action

Revert "Use internal Apple codesign action"

Merge pull request #14337 from cli/williammartin-ghes-api-telemetry

Disable telemetry for unauthenticated GHES `gh api` requests using absolute hostnames

Merge pull request #14260 from cli/tommaso-moro-support-pi-agent-dire…

…ctory

Support PI_CODING_AGENT_DIR for skills

Merge commit from fork

fix: bind to loopback by default in `codespace ports forward`