[backport] Issue dependency read/write tools (upstream main)

[gastrodon]

Summary

Two new feature-flagged tools for issue blocked-by/blocking relationships, gated behind the issue_dependencies feature flag (auto-enabled for insiders):

• issue_dependency_read: get_blocked_by / get_blocking via Issue.blockedBy / Issue.blocking GraphQL connections, cursor-paginated
• issue_dependency_write: add / remove × blocked_by / blocking via addBlockedBy / removeBlockedBy mutations; accepts issue numbers, resolves to node IDs in a single aliased query; self-dependency rejected before any round-trip

New file: pkg/github/issue_dependencies.go (448 lines) with AddBlockedByInput and RemoveBlockedByInput GraphQL input types, dependencyConnection structs, and tool registrations in tools.go + feature_flags.go.

Upstream reference

• version: upstream main (post v1.4.0, unreleased)
• commits: github@067756a
• PR: Add issue dependency read/write MCP tools github/github-mcp-server#2751

Fork conflict

Mild design consideration. The fork has issue_graph which traverses issue hierarchies (sub-issues, body references, timeline cross-references) via BFS. Blocked-by/blocking relationships are a separate relationship axis not yet covered by issue_graph. The upstream adds standalone tools; the fork might prefer these integrated into issue_graph's traversal. However, the standalone tools are additive and don't break issue_graph.

Context

Fills the MCP gap behind the gh CLI's gh issue block / gh issue unblock verbs (cli/cli#13057). Agents working with issue dependency graphs now have read and write access to the full relationship graph without needing the CLI.

[gastrodon]

Unified Changelog — upstream main since v1.4.0

See #10 for the full changelog. Summary:

• [backport] OAuth 2.1 stdio login (upstream main) [story] #13 (story): OAuth 2.1 stdio login → sub-issues [backport] OAuth 2.1 core library — PKCE + device flows (upstream main) #10 [backport] Wire OAuth 2.1 login into stdio server (upstream main) #11 [backport] OAuth build-time credentials + docs (upstream main) #12
• [backport] Issue dependency read/write tools (upstream main) #14: Issue dependency read/write tools
• [backport] get_parent method for issue_read (upstream main) #15: get_parent for issue_read
• [backport] Promote issue fields to default, remove legacy issue_write methods (upstream main) #16: Promote issue fields, remove legacy issue_write
• [backport] Remove show_ui parameter, centralize show/defer decision (upstream main) #17: Remove show_ui, centralize show/defer
• [backport] Fix delete:true on issue fields — REST DELETE fallback (upstream main) #18: Fix delete:true on issue fields
• [backport] Bound ui_get pagination to prevent latency spikes (upstream main) #19: Bound ui_get pagination
• [backport] Fix issue_write MCP App form gating for labels/assignees/milestone/type (upstream main) #20: Fix issue_write form gating
• [backport] Validate required params in add_comment_to_pending_review (upstream main) #21: Validate required params in add_comment_to_pending_review

[gastrodon]

No-op. The fork already contains pkg/github/issue_dependencies.go (AddBlockedByInput, RemoveBlockedByInput, dependencyConnection structs, issue_dependency_read and issue_dependency_write tool registrations) and the corresponding pkg/github/issue_dependencies_test.go. Feature flag issue_dependencies is registered in feature_flags.go. No work needed.