Add set_issue_fields to guard write coverage and DIFC rules

Agent-Logs-Url: https://github.com/github/gh-aw-mcpg/sessions/70c367d1-6251-4a1a-9af4-37658ef8f89e

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Author: Copilot

guards/github-guard/rust-guard/src/labels/mod.rs

@@ -4753,6 +4753,7 @@ mod tests {
             "update_issue_state",
             "update_issue_title",
             "update_issue_type",
+            "set_issue_fields",
         ] {
             let (secrecy, integrity, _desc) = apply_tool_labels(
                 tool,

guards/github-guard/rust-guard/src/labels/tool_rules.rs

@@ -543,6 +543,7 @@ pub fn apply_tool_labels(
         | "update_issue_state"
         | "update_issue_title"
         | "update_issue_type"
+        | "set_issue_fields"
         | "add_sub_issue"
         | "remove_sub_issue"
         | "reprioritize_sub_issue"

guards/github-guard/rust-guard/src/tools.rs

@@ -99,6 +99,7 @@ pub const READ_WRITE_OPERATIONS: &[&str] = &[
     "update_issue_state",     // PATCH — opens or closes an issue
     "update_issue_title",     // PATCH — modifies issue title
     "update_issue_type",      // PATCH — modifies issue type
+    "set_issue_fields",       // GraphQL — sets org-level custom field values on an issue
 
     // Sub-issue management tools (alongside sub_issue_write composite)
     "add_sub_issue",          // POST  /repos/.../issues/{number}/sub_issues
@@ -348,6 +349,7 @@ mod tests {
             "update_issue_state",
             "update_issue_title",
             "update_issue_type",
+            "set_issue_fields",
         ] {
             assert!(
                 is_read_write_operation(op),