[log] Add debug logging to proxy upstream forwarding

[github-actions]

Adds 5 debug log calls to internal/proxy/proxy.go, reusing the existing logProxy logger:

• upstreamHost: scheme-less parse retry and raw host fallback
• forwardToGitHub: GraphQL URL rewrite (GHES or not), request creation failure, artifact zip no-redirect path

The log arguments have no side effects. They don't log paths, URLs or credentials, so enclave and delegation modes stay safe.

Validation: go vet and go test ./internal/proxy pass, and go build succeeds.

Generated by Go Logger Enhancement · copilot · auto · 62.4 AIC · ⊞ 12.8K · ◷

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Note

This error may be related to your runner configuration. You can now configure runners for Copilot code review separately from Copilot cloud agent by creating a copilot-code-review.yml file with your setup steps. Read the docs for details.

[Copilot]

Copilot review overview

🟡 Changes recommended

Two new diagnostics can expose sensitive URL data when parsing fails.

Review effort: Balanced
Findings: 2

Open (2)

• Fallback host logging exposes credentials for malformed scheme-less URLs · New
• Raw URL parse errors expose credentials and query data in debug logs · New

[github-actions]

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads	data	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all 6 tools absent from catalog	BLOCKED	⚠️
C	CLI	reads	data	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment)	not attempted — gh unauthenticated	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	not attempted — gh unauthenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE
(⚠️ = Part B's 6 targeted write tools were absent from the exposed 23-tool catalog — a refusal there reflects gh-aw's backend GITHUB_READ_ONLY=1 config, not independent proof of mcpg's own gateway-level enforcement. Part D/E could not run because gh auth status reported "not logged into any GitHub hosts" in this environment, so no REST/GraphQL write attempts were made. No write succeeded or leaked on any surface.)

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime