Compiler does not propagate enterprise host into curated DIFC-proxy env on *.ghe.com

[lpcox]

Summary

On GitHub Enterprise Cloud data-residency tenants (*.ghe.com), the gh-aw compiler launches the mcpg DIFC proxy (via actions/setup/sh/start_difc_proxy.sh) with a curated environment that does not carry the enterprise GitHub host. As a result the proxy targets github.com/api.github.com instead of the tenant *.ghe.com API host, and gh api calls forwarded through it fail.

Downstream, the AWF firewall's awf-cli-proxy sidecar liveness probe fails with diagnosis=unknown, the firewall fails fast, and the agent is never invoked.

This is the gh-aw / compiler-side piece of #41225.

Environment

• gh-aw v0.80.9/v0.81.2; firewall v0.27.7/0.27.9; mcpg v0.3.27/v0.3.29
• Standard GitHub-hosted ubuntu-24 runner
• GitHub Enterprise Cloud, data residency (*.ghe.com)
• engine: copilot (org-billed inference)

Details

The reporter set workflow-level GH_HOST / GITHUB_HOST / GITHUB_ENTERPRISE_HOST to the enterprise host. These reach the AWF cli-proxy via --env-all, but not the DIFC proxy, because start_difc_proxy.sh builds its own curated env. So the proxy never learns the enterprise host.

This is closely related to #21407 (compiler doesn't inject GH_HOST/telemetry for *.ghe.com).

Proposed fix

1. Derive the enterprise host from GITHUB_SERVER_URL at compile/launch time.
2. Propagate it into the curated env passed to the DIFC proxy in start_difc_proxy.sh (e.g. GH_HOST, GITHUB_API_URL, tenant Copilot endpoint), so the proxy in github/gh-aw-mcpg can target the correct host.
3. Add data-residency coverage so engine: copilot on *.ghe.com is exercised.

Acceptance

• On a *.ghe.com tenant, the DIFC proxy receives the enterprise host in its env.
• The forwarded gh api rate_limit returns 2xx, the AWF probe succeeds, and the agent runs.

Companion issues

This is tracked across three repositories:

• Compiler does not propagate enterprise host into curated DIFC-proxy env on *.ghe.com #41911 — (this issue) compiler/env propagation: inject the enterprise host into the curated DIFC-proxy env
• DIFC proxy is not enterprise-host-aware on GHEC data-residency (*.ghe.com) gh-aw-mcpg#8202 — DIFC proxy enterprise-host awareness (root cause)
• Improve awf-cli-proxy DIFC probe diagnostics (replace opaque diagnosis=unknown) gh-aw-firewall#5615 — awf-cli-proxy probe diagnostics: replace opaque diagnosis=unknown with the actual HTTP status/body

Original report: #41225
Related: #21407, github/gh-aw-firewall#1300