fix(issues): strip invisible characters from add_issue_comment body

Filter BiDi and other invisible Unicode control characters from issue
comment bodies before posting to GitHub. These characters can render as
visible separators and break @mentions such as @dependabot rebase.

Fixes #2714

Author: syf2211

pkg/github/issues.go

@@ -1243,6 +1243,10 @@ func AddIssueComment(t translations.TranslationHelperFunc) inventory.ServerTool
 
 			var commentResponse *MinimalResponse
 			if hasBody {
+				body = sanitize.FilterInvisibleCharacters(body)
+				if body == "" {
+					return utils.NewToolResultError("body cannot be empty after removing invisible characters"), nil, nil
+				}
 				comment := &github.IssueComment{
 					Body: github.Ptr(body),
 				}

pkg/github/issues_test.go

@@ -4154,6 +4154,21 @@ func TestAddIssueComment(t *testing.T) {
 				"body":         "This is a comment",
 			},
 		},
+		{
+			name: "strips invisible characters from comment body before posting",
+			mockedClient: MockHTTPClientWithHandlers(map[string]http.HandlerFunc{
+				PostReposIssuesCommentsByOwnerByRepoByIssueNumber: expect(t, expectations{
+					path:        "/repos/owner/repo/issues/42/comments",
+					requestBody: map[string]any{"body": "@dependabot rebase"},
+				}).andThen(mockResponse(t, http.StatusCreated, mockComment)),
+			}),
+			requestArgs: map[string]any{
+				"owner":        "owner",
+				"repo":         "repo",
+				"issue_number": float64(42),
+				"body":         "\u2068@\u2069\u2068d\u2069ependabot rebase",
+			},
+		},
 		{
 			name: "successful reaction to issue",
 			mockedClient: MockHTTPClientWithHandlers(map[string]http.HandlerFunc{