feat: add copilot-setup-steps.yml — install CSM-LLM-QA@main with SHA-pinned pip cache

[Copilot]

Copilot cloud agent had no pre-install setup, requiring it to discover and install CSM-LLM-QA ad-hoc each session. This adds a copilot-setup-steps.yml that always tracks main while keeping the pip cache effective.

Key design

• Dynamic main resolution — git ls-remote fetches the latest commit SHA of CSM-LLM-QA@main without cloning. No GitHub API rate-limit concern.
• SHA-pinned install — pip install git+...@<SHA> (not @main) so pip can match the exact wheel in its cache, rather than re-cloning on every run.
• Cache key = SHA — actions/cache key is pip-csm-llm-qa-<SHA>: exact hit when main hasn't changed; restore-keys: pip-csm-llm-qa- gives a partial hit on SHA change, reusing already-cached heavy deps (chromadb, sentence-transformers, openai) and only rebuilding the CSM-LLM-QA wheel.
• Fail-fast on empty SHA — explicit guard prevents silent downstream failures if the remote is unreachable.

- name: Get CSM-LLM-QA latest main SHA
  id: csm-sha
  run: |
    SHA=$(git ls-remote https://github.com/NEVSTOP-LAB/CSM-LLM-QA.git refs/heads/main | cut -f1)
    if [ -z "$SHA" ]; then echo "ERROR: ..." >&2; exit 1; fi
    echo "sha=$SHA" >> "$GITHUB_OUTPUT"

- name: Cache pip packages
  uses: actions/cache@v4
  with:
    path: ~/.cache/pip
    key: pip-csm-llm-qa-${{ steps.csm-sha.outputs.sha }}
    restore-keys: pip-csm-llm-qa-

- name: Install CSM-LLM-QA from main
  run: pip install "git+https://github.com/NEVSTOP-LAB/CSM-LLM-QA.git@${{ steps.csm-sha.outputs.sha }}"

[Copilot]

Pull request overview

Adds a Copilot coding-agent setup workflow so cloud agent sessions can pre-install CSM-LLM-QA with an SHA-keyed pip cache.

Changes:

• Adds .github/workflows/copilot-setup-steps.yml with the required copilot-setup-steps job.
• Resolves CSM-LLM-QA@main to a commit SHA before install.
• Caches ~/.cache/pip using the resolved SHA with prefix restore fallback.