refactor(copilot): remove duplicate example implementation

agent-governance-copilot-cli/README.md

@@ -17,10 +17,10 @@ It uses `@microsoft/agent-governance-sdk` as the runtime dependency for the inst
 
 ## Why this package exists
 
-The repo also contains `examples/copilot-cli-agt`, which remains the tutorial and scenario-driven
-reference implementation. This package exists so production installs do **not** depend on:
+The repo also contains `examples/copilot-cli-agt`, which provides the scenario-driven tutorial.
+This package owns the extension source, policy profiles, installer, and tests so production
+installs do **not** depend on:
 
-- example-local scripts
 - repo-local SDK builds
 - `npm install` side effects that mutate `~/.copilot`
 
@@ -43,7 +43,7 @@ From the repo during development:
 
 ```powershell
 cd agent-governance-copilot-cli
-npm install
+npm ci
 node .\bin\agt-copilot.mjs install
 node .\bin\agt-copilot.mjs update --force-policy
 ```
@@ -140,10 +140,12 @@ The packaged default policy is a developer-protection baseline that:
 - scans fetched-content tools for poisoning and exfiltration cues
 - inspects `bash` and `powershell` output in advisory mode so suspicious output is surfaced without being silently dropped
 
-For this PR, the package keeps that strict baseline as the shipped default. Example profile
-starting points for `strict`, `balanced`, and `advisory` live under:
+The package ships that strict baseline as the default. The `strict`, `balanced`, and `advisory`
+profiles live under:
 
-- `examples/copilot-cli-agt/config/profiles/`
+- `assets/extensions/agt-global-policy/config/profiles/`
+
+Apply a bundled profile with `agt-copilot policy apply --profile <name>`.
 
 ## Notes
 
@@ -158,5 +160,11 @@ starting points for `strict`, `balanced`, and `advisory` live under:
 
 For a concrete walkthrough and test prompts, see:
 
-- `examples/copilot-cli-agt`
-- `examples/copilot-cli-agt/scenarios/guarded-repo-triage`
+- [`examples/copilot-cli-agt`](../examples/copilot-cli-agt/README.md)
+- [the guarded repo-triage scenario](../examples/copilot-cli-agt/scenarios/guarded-repo-triage/README.md)
+
+## Design references
+
+The extension packaging and user experience were informed by
+[`DamianEdwards/copilot-cli-cost`](https://github.com/DamianEdwards/copilot-cli-cost) and the
+[`htek.dev` Copilot CLI extensions guide](https://htek.dev/articles/github-copilot-cli-extensions-complete-guide).

docs/packages/copilot-cli-governance.md

@@ -1,6 +1,6 @@
 ---
 title: "@microsoft/agent-governance-copilot-cli — Copilot CLI governance package"
-last_reviewed: 2026-06-08
+last_reviewed: 2026-09-03
 owner: agt-maintainers
 ---
 
@@ -25,7 +25,7 @@ install, update, uninstall, and diagnostics.
 
 - not a `postinstall` package that silently writes into the user home directory
 - not a replacement for organization-wide governance controls
-- not the tutorial story; the runnable walkthrough remains in `examples/copilot-cli-agt`
+- not the tutorial itself; the guarded walkthrough remains in `examples/copilot-cli-agt`
 
 ## Install
 
@@ -111,9 +111,10 @@ The packaged default policy:
 - scans fetched-content tools for poisoning and exfiltration cues
 - inspects `bash` and `powershell` output in advisory mode so suspicious shell output is flagged without suppressing routine build and test logs
 
-This PR keeps that behavior as the shipped **strict** baseline. For reviewer discussion and local
-experimentation, example `strict`, `balanced`, and `advisory` profiles are included under
-`examples/copilot-cli-agt/config/profiles/`.
+The package ships that behavior as the **strict** baseline. The `strict`, `balanced`, and
+`advisory` profiles live under
+`agent-governance-copilot-cli/assets/extensions/agt-global-policy/config/profiles/` and can be
+applied with `agt-copilot policy apply --profile <name>`.
 
 The installed extension still carries its own bundled default policy so it can fall back safely if
 the user policy file is missing or invalid.

docs/tutorials/46-copilot-cli-governance.md

@@ -1,6 +1,6 @@
 ---
 title: "Tutorial 46 — Copilot CLI governance installer"
-last_reviewed: 2026-05-15
+last_reviewed: 2026-09-03
 owner: agt-maintainers
 ---
 
@@ -122,28 +122,27 @@ Doctor validates:
 If doctor reports an invalid policy, remove `~/.copilot/agt/policy.json` or set
 `AGT_COPILOT_POLICY_PATH` to a valid replacement before reloading Copilot CLI.
 
-### Try an example policy profile
+### Try a bundled policy profile
 
-The example repo path includes ready-to-copy policy profiles:
+The installer package includes these policy profiles:
 
-- `examples/copilot-cli-agt/config/profiles/strict.json`
-- `examples/copilot-cli-agt/config/profiles/balanced.json`
-- `examples/copilot-cli-agt/config/profiles/advisory.json`
+- `strict`
+- `balanced`
+- `advisory`
 
-For example:
+Apply one through the installer CLI:
 
-```powershell
-Copy-Item .\examples\copilot-cli-agt\config\profiles\balanced.json $HOME\.copilot\agt\policy.json -Force
+```bash
+agt-copilot policy apply --profile balanced
 ```
 
 Then reload Copilot CLI with `/clear` and inspect the result with `/agt status`.
 
-You can also manage policy files directly with the installer CLI:
+Other policy-management commands include:
 
 ```bash
 agt-copilot policy path
 agt-copilot policy validate
-agt-copilot policy apply --profile balanced
 ```
 
 ### Node is missing