[log] Add debug logging to files with minimal or no existing coverage

[github-actions]

Summary

Adds pkg:filename-namespaced pkg/logger debug logging to 5 Go files in pkg/ that had zero or minimal existing debug logging, per the Go Logger Enhancement mission.

Files changed

• pkg/workflow/memory_validation_config.go - no prior logging. Added logs for: use of the legacy validation-script/custom-validation fields, rejection of the deprecated timeout field, and application of the default timeout when unset.
• pkg/workflow/enclaves.go - no prior logging. Added logs at validateEnclavesConfig entry (count of enclaves being validated), the two hard-rejection branches (missing AWF network isolation, incompatibility with tools.github.bounded-queries), and the number of AWF enclave configs built in buildAWFEnclavesConfig.
• pkg/typeutil/lookup.go - no prior logging. Added logs in LookupStringPath for each of its three failure branches (missing key, non-string leaf value, non-map intermediate value), which previously failed silently.
• pkg/workflow/mcp_renderer_guard.go - had exactly 1 existing log call (an error path). Added entry logs to renderGuardPoliciesJSON and renderGuardPoliciesToml noting how many guard-policy entries are being rendered, reusing the existing shared mcpRendererLog.
• pkg/workflow/dismiss_pull_request_review.go - had exactly 1 existing log call. Added logs for: use of the legacy dismiss-review alias key, rejection due to invalid target config, and the non-map config fallback path.

All new log arguments are simple field/length reads (no side effects or expensive computation). No existing log calls were duplicated.

Selection process note

The pre-flight manifest.json files_needing_logger list proved unreliable as a direct source of truth - it flags files lacking their own local logger.New(...) call even when they already have extensive logging via a shared or parameter-passed logger. Several of its top entries (e.g. pkg/parser/import_topological.go, pkg/workflow/action_resolver.go) were already thoroughly logged and were rejected after reading their contents. Candidates here were instead selected by directly verifying each files actual logging coverage against its logic complexity.

Validation

make build / make fmt could not be run to completion in this environment: the repos go.mod requires go >= 1.26.5, but the go binary resolved by make in this sandbox is 1.24.13 with GOTOOLCHAIN=local, so the toolchain check fails before compiling anything (pre-existing environment issue, unrelated to this diff, and already present at the base commit). Direct invocation of go/gofmt binaries (including ones at other installed toolchain paths available on disk) is also blocked by the sandbox in this non-interactive run. All five diffs were manually re-read for syntax correctness, import-cycle safety (confirmed pkg/logger does not depend on pkg/typeutil or pkg/workflow), matching indentation/brace structure, and absence of duplicate variable names in their packages.

Generated with automated Go Logger Enhancement workflow.

Generated by 📝 Go Logger Enhancement · agent · 457.4 AIC · ⌖ 28.6 AIC · ⊞ 6K · ◷

• expires on Aug 15, 2026, 8:11 PM UTC-08:00