How to Adopt Microsoft Copilot Securely: A Governance-First Framework