Copilot plugin marketplace allowlists

GitHub added enterprise-managed strictKnownMarketplaces support so Copilot CLI and VS Code plugin installs can be restricted to approved marketplace sources. Why it matters: Agent extensions and plugins are now a supply-chain surface. Marketplace allowlists make tool installation policy part of coding-agent governance rather than an informal setup choice.

Try this: Before expanding agent plugins, list approved marketplaces, define who can add new sources, and keep high-privilege plugins out of default agent profiles.