fix: allow public_repo for public contribution tools (#3140)

* fix: allow public_repo for contribution tools

* test: tighten public repo scope coverage

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix: separate public repo visibility from OAuth scopes

Keep public_repo as a fixed-token visibility capability while requiring repo for per-call OAuth challenges. Challenge only missing scopes for workflow pushes.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Paulcake <171492698+paulcakeface@users.noreply.github.com>
Co-authored-by: Sam Morrow <sammorrowdrums@github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>