[log] Add debug logging to cmd/proxy (#4134)

Adds 5 new `logProxyCmd` debug log calls to `internal/cmd/proxy.go` to
improve troubleshooting of the `awmg proxy` subcommand.

## Changes

**`internal/cmd/proxy.go`** — reuses the existing `logProxyCmd =
logger.New("cmd:proxy")` logger:

- Log proxy server creation parameters before `proxy.New` (guard path,
policy presence, DIFC mode, trusted bot/user counts)
- Log successful proxy server creation
- Log HTTP server creation with TLS state
- Log when TLS configuration is applied to the HTTP server
- Log entry to `configureTLSTrustEnvironment` (CA cert path + env var
names)
- Log successful TLS trust environment configuration

## Usage

Enable with `DEBUG=cmd:proxy ./awmg proxy ...` or `DEBUG=* ./awmg proxy
...`.

## Validation

- `go build` passes (GOTOOLCHAIN=auto go1.25.0)
- `go vet ./internal/cmd/...` passes
- `gofmt` clean
- All unit tests pass (pre-existing `TestFetchAndFixSchema_NetworkError`
failure is unrelated to this change and reproducible on `main` without
my changes)




> [!WARNING]
> <details>
> <summary><strong>⚠️ Firewall blocked 1 domain</strong></summary>
>
> The following domain was blocked by the firewall during workflow
execution:
>
> - `invalidhostthatdoesnotexist12345.com`
>
> To allow these domains, add them to the `network.allowed` list in your
workflow frontmatter:
>
> ```yaml
> network:
>   allowed:
>     - defaults
>     - "invalidhostthatdoesnotexist12345.com"
> ```
>
> See [Network
Configuration](https://github.github.com/gh-aw/reference/network/) for
more information.
>
> </details>


> Generated by [Go Logger
Enhancement](https://github.com/github/gh-aw-mcpg/actions/runs/24621566931/agentic_workflow)
· ● 5.8M ·
[◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw-mcpg+%22gh-aw-workflow-id%3A+go-logger%22&type=pullrequests)

<!-- gh-aw-agentic-workflow: Go Logger Enhancement, engine: copilot,
model: auto, id: 24621566931, workflow_id: go-logger, run:
https://github.com/github/gh-aw-mcpg/actions/runs/24621566931 -->

<!-- gh-aw-workflow-id: go-logger -->

Author: lpcox

internal/cmd/proxy.go

@@ -203,6 +203,8 @@ func runProxy(cmd *cobra.Command, args []string) error {
 	logProxyCmd.Printf("Resolved GitHub API URL: %s, explicit flag=%v", apiURL, proxyAPIURL != "")
 
 	// Create the proxy server
+	logProxyCmd.Printf("Creating proxy server: guard=%s, hasPolicy=%v, mode=%s, trustedBots=%d, trustedUsers=%d",
+		proxyGuardWasm, proxyPolicy != "", proxyDIFCMode, len(proxyTrustedBots), len(proxyTrustedUsers))
 	proxySrv, err := proxy.New(ctx, proxy.Config{
 		WasmPath:     proxyGuardWasm,
 		Policy:       proxyPolicy,
@@ -215,6 +217,7 @@ func runProxy(cmd *cobra.Command, args []string) error {
 	if err != nil {
 		return fmt.Errorf("failed to create proxy server: %w", err)
 	}
+	logProxyCmd.Printf("Proxy server created successfully")
 
 	// Generate TLS certificates if requested
 	var tlsCfg *proxy.TLSConfig
@@ -235,11 +238,13 @@ func runProxy(cmd *cobra.Command, args []string) error {
 	}
 
 	// Create the HTTP server
+	logProxyCmd.Printf("Creating HTTP server: addr=%s, tls=%v", proxyListen, tlsCfg != nil)
 	httpServer := &http.Server{
 		Addr:    proxyListen,
 		Handler: proxySrv.Handler(),
 	}
 	if tlsCfg != nil {
+		logProxyCmd.Printf("Applying TLS configuration to HTTP server")
 		httpServer.TLSConfig = tlsCfg.Config
 	}
 
@@ -318,10 +323,12 @@ func configureTLSTrustEnvironment(caCertPath string) error {
 		return fmt.Errorf("invalid TLS CA cert path contains newline")
 	}
 
+	logProxyCmd.Printf("Configuring TLS trust environment: caCertPath=%s, envVars=%v", caCertPath, tlsTrustEnvKeys)
 	for _, key := range tlsTrustEnvKeys {
 		if err := os.Setenv(key, caCertPath); err != nil {
 			return fmt.Errorf("failed to set %s: %w", key, err)
 		}
 	}
+	logProxyCmd.Printf("TLS trust environment configured successfully: %d env vars set", len(tlsTrustEnvKeys))
 	return nil
 }