fix(scopes): require workflow scope opt-in

Keep workflow and codespace in protected-resource discovery while excluding both from the default OAuth grant alongside delete_repo.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 4b04480c-c2e9-483e-9b0f-34830b76a2f8

Author: SamMorrowDrums

pkg/scopes/scopes.go

@@ -86,8 +86,8 @@ var oauthScopeDefinitions = []oauthScopeDefinition{
 	{scope: Project, byDefault: true},
 	{scope: Gist, byDefault: true},
 	{scope: Notifications, byDefault: true},
-	{scope: Workflow, byDefault: true},
-	{scope: Codespace, byDefault: true},
+	{scope: Workflow},
+	{scope: Codespace},
 }
 
 // SupportedOAuthScopes returns every OAuth scope the server may request.

pkg/scopes/scopes_test.go

@@ -127,8 +127,10 @@ func TestOAuthScopeCatalog(t *testing.T) {
 	assert.Subset(t, supported, defaults)
 	assert.Contains(t, supported, string(DeleteRepo))
 	assert.NotContains(t, defaults, string(DeleteRepo))
-	assert.Contains(t, defaults, string(Workflow))
-	assert.Contains(t, defaults, string(Codespace))
+	assert.Contains(t, supported, string(Workflow))
+	assert.NotContains(t, defaults, string(Workflow))
+	assert.Contains(t, supported, string(Codespace))
+	assert.NotContains(t, defaults, string(Codespace))
 }
 
 func TestToStringSlice(t *testing.T) {