[log] Add debug logging to difc/reflect.go

[github-actions]

Adds a logReflect debug logger (namespace difc:reflect) to internal/difc/reflect.go.

Changes

File modified: internal/difc/reflect.go

• Added var logReflect = logger.New("difc:reflect") following the pkg:filename convention used across the difc package
• Added 5 meaningful log calls inside BuildReflectResponse:
  1. Entry — logs current enforcement mode (e.g. strict, filter, propagate)
  2. Agent count — logs how many agents the registry reports before iterating
  3. Skipped agents — logs when an agent ID cannot be resolved to an *AgentLabels (was silently continued before)
  4. No registry — logs the new else branch when AgentRegistry == nil
  5. Completion — logs mode and total reflected agent count

Why

BuildReflectResponse is called by the /reflect endpoint to snapshot all agent DIFC labels. Without logging it was impossible to tell at debug time whether zero agents were reflected because the registry was empty, nil, or because agents failed lookups. These log calls (controlled by DEBUG=difc:reflect or DEBUG=difc:*) provide that visibility with zero overhead when the debug logger is disabled.

Validation

• make agent-finished passed: format ✓, build ✓, lint ✓, all Go tests ✓ (unit + integration)
• Rust guard tests failed due to sandboxed network blocking crates.io — unrelated to this change

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• index.crates.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "index.crates.io"

See Network Configuration for more information.

Generated by Go Logger Enhancement · sonnet46 4.2M · ◷