[log] Add debug logging to GitHub API URL derivation (#6043)

## Summary

Adds meaningful debug logging to `internal/envutil/github.go` for the
`deriveAPIFromServerURL` function, which previously had **no logging**
despite containing important control-flow decisions.

## Changes

**File:** `internal/envutil/github.go`

### New logging in `deriveAPIFromServerURL`
- Logs entry with the raw server URL being parsed
- Logs when URL parsing fails or returns an empty host
- Logs when an unsupported scheme (not `http`/`https`) is detected
- Logs which resolution path was taken for each case:
  - `github.com` → default API URL
  - `*.ghe.com` tenant → `copilot-api.<tenant>.ghe.com`
  - GHES instance → `<host>/api/v3`

### New logging in `DeriveGitHubAPIURL`
- Logs when falling back to the caller-provided `defaultURL`

## Why this matters

When debugging "why is the gateway using the wrong GitHub API URL?" or
"why isn't my GHEC tenant resolving correctly?", operators previously
had no visibility into which resolution branch was taken. The new
`DEBUG=envutil:*` log lines make this transparent.

## Testing

- Pre-existing test failure in `internal/config`
(`TestFetchAndFixSchema_NetworkError` — HTTP 403 network issue)
confirmed to be unrelated and present on the base branch.
- All other unit and integration tests pass.




> [!WARNING]
> <details>
> <summary>Firewall blocked 1 domain</summary>
>
> The following domain was blocked by the firewall during workflow
execution:
>
> - `invalidhostthatdoesnotexist12345.com`
>> To allow these domains, add them to the `network.allowed` list in
your workflow frontmatter:
>
> ```yaml
> network:
>   allowed:
>     - defaults
>     - "invalidhostthatdoesnotexist12345.com"
> ```
>
> See [Network
Configuration](https://github.github.com/gh-aw/reference/network/) for
more information.
>
> </details>


> Generated by [Go Logger
Enhancement](https://github.com/github/gh-aw-mcpg/actions/runs/26132068575/agentic_workflow)
· ● 5M ·
[◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw-mcpg+%22gh-aw-workflow-id%3A+go-logger%22&type=pullrequests)

<!-- gh-aw-agentic-workflow: Go Logger Enhancement, engine: copilot,
version: 1.0.40, model: claude-sonnet-4.6, id: 26132068575, workflow_id:
go-logger, run:
https://github.com/github/gh-aw-mcpg/actions/runs/26132068575 -->

<!-- gh-aw-workflow-id: go-logger -->

Author: lpcox

internal/envutil/github.go

@@ -7,6 +7,7 @@ import (
 	"strings"
 
 	"github.com/github/gh-aw-mcpg/internal/logger"
+	"github.com/github/gh-aw-mcpg/internal/logger/sanitize"
 )
 
 var logGitHub = logger.New("envutil:github")
@@ -66,37 +67,50 @@ func DeriveGitHubAPIURL(defaultURL string) string {
 	if serverURL := strings.TrimSpace(os.Getenv("GITHUB_SERVER_URL")); serverURL != "" {
 		derived := deriveAPIFromServerURL(serverURL)
 		if derived != "" {
-			logGitHub.Printf("GitHub API URL derived from GITHUB_SERVER_URL=%s: %s", serverURL, derived)
+			logGitHub.Printf("GitHub API URL derived from GITHUB_SERVER_URL=%s: %s", sanitize.RedactURL(serverURL), sanitize.RedactURL(derived))
 			return derived
 		}
 	}
-	return strings.TrimRight(strings.TrimSpace(defaultURL), "/")
+	result := strings.TrimRight(strings.TrimSpace(defaultURL), "/")
+	logGitHub.Printf("GitHub API URL falling back to provided default: %s", sanitize.RedactURL(result))
+	return result
 }
 
 // deriveAPIFromServerURL converts a GITHUB_SERVER_URL to the corresponding API endpoint.
 // GHEC tenants (*.ghe.com): https://tenant.ghe.com → https://copilot-api.tenant.ghe.com
 // GitHub.com: https://github.com → https://api.github.com
 // GHES (all others): https://github.example.com → https://github.example.com/api/v3
 func deriveAPIFromServerURL(serverURL string) string {
+	logGitHub.Printf("Deriving API URL from server URL: %s", sanitize.RedactURL(serverURL))
+
 	parsed, err := url.Parse(strings.TrimRight(serverURL, "/"))
 	if err != nil || parsed.Host == "" {
+		logGitHub.Printf("Failed to parse server URL or empty host: serverURL=%s, err=%v", sanitize.RedactURL(serverURL), err)
 		return ""
 	}
 	if parsed.Scheme != "http" && parsed.Scheme != "https" {
+		logGitHub.Printf("Unsupported scheme in server URL: scheme=%s, serverURL=%s", parsed.Scheme, sanitize.RedactURL(serverURL))
 		return ""
 	}
 
 	hostname := strings.ToLower(parsed.Hostname())
 
 	switch {
 	case hostname == "github.com" || hostname == "www.github.com":
+		logGitHub.Printf("GitHub.com detected, using default API URL: %s", DefaultGitHubAPIBaseURL)
 		return DefaultGitHubAPIBaseURL
 	case strings.HasSuffix(hostname, ".ghe.com"):
+		var apiURL string
 		if port := parsed.Port(); port != "" {
-			return fmt.Sprintf("%s://copilot-api.%s:%s", parsed.Scheme, hostname, port)
+			apiURL = fmt.Sprintf("%s://copilot-api.%s:%s", parsed.Scheme, hostname, port)
+		} else {
+			apiURL = fmt.Sprintf("%s://copilot-api.%s", parsed.Scheme, hostname)
 		}
-		return fmt.Sprintf("%s://copilot-api.%s", parsed.Scheme, hostname)
+		logGitHub.Printf("GHEC tenant detected, using copilot-api subdomain: hostname=%s, apiURL=%s", hostname, apiURL)
+		return apiURL
 	default:
-		return fmt.Sprintf("%s://%s/api/v3", parsed.Scheme, parsed.Host)
+		apiURL := fmt.Sprintf("%s://%s/api/v3", parsed.Scheme, parsed.Host)
+		logGitHub.Printf("GHES instance detected, using /api/v3 path: host=%s, apiURL=%s", parsed.Host, apiURL)
+		return apiURL
 	}
 }