After weeks of tinkering, I got Microsoft Copilot Studio running inside Salesforce Lightning with Entra ID SSO and full MSAL token flow.
The component, LightningCopilot, handles auth, chat, and adaptive cards cleanly — no Locker violations.
Full guide (and all the gotchas) below.