Fix MCP tool naming in security workflows

[Copilot]

Three security workflows instructed agents to call GitHub MCP tools using hyphen-separated names (github-list_code_scanning_alerts), but the MCP gateway registers tools with triple underscores (github___list_code_scanning_alerts), causing workflow failures.

Changes

• code-scanning-fixer.md: Updated 4 tool references to use github___ prefix
• dependabot-bundler.md: Updated 1 tool reference
• secret-scanning-triage.md: Updated 2 tool references
• Regenerated corresponding .lock.yml files

Example

-**Tool Usage**: Tool names are prefixed with `github-` (e.g., `github-list_code_scanning_alerts`)
+**Tool Usage**: Tool names use triple underscores: `github___` (e.g., `github___list_code_scanning_alerts`)

-Use the GitHub MCP server to list all open code scanning alerts:
-- Call `github-list_code_scanning_alerts` tool with the following parameters:
+- Call `github___list_code_scanning_alerts` tool with the following parameters:

The MCP gateway registration pattern is {server_id}___{tool_name}, confirmed in workflow logs showing Registered tool: github___get_code_scanning_alert.

Original prompt

Fix code scanning fixer: https://github.com/githubnext/gh-aw/actions/runs/21395340331/job/61592174378

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.