[log] Add debug logging to config_core.go (#4074)

Adds 5 meaningful debug logging calls to
`internal/config/config_core.go` using the existing `logConfig` logger
(`"config:config"`).

## Changes

**`applyGatewayDefaults`** — logs resolved defaults after all zero-value
fields are filled in:
```
Applied gateway defaults: port=3000, startupTimeout=30, toolTimeout=60, keepaliveInterval=1500
```

**`LoadFromFile`** — adds intermediate progress logs between the
existing entry/exit log calls:

1. Before unknown-field check: `Checking N undecoded TOML keys against
allowed fields`
2. Before stdio containerization validation: `Validating stdio server
containerization requirements for N servers`
3. Before auth validation loop: `Validating auth configuration for N
servers`
4. When `opentelemetry` section is present: `opentelemetry section
found: merging into tracing config, endpoint=...`

## Why

`LoadFromFile` already logs at entry and exit but its many intermediate
validation steps were invisible under debug logging. These additions
make it easy to pinpoint which validation step fails or how far
initialization progressed when troubleshooting startup issues with
`DEBUG=config:*`.

## Validation

- `go build ./...` — passes ✅
- `go vet ./...` — passes ✅
- `go test ./internal/...` — all packages pass; only
`TestFetchAndFixSchema_NetworkError` fails, which is a **pre-existing**
network-dependent test failure unrelated to these changes ✅




> [!WARNING]
> <details>
> <summary><strong>⚠️ Firewall blocked 1 domain</strong></summary>
>
> The following domain was blocked by the firewall during workflow
execution:
>
> - `invalidhostthatdoesnotexist12345.com`
>
> To allow these domains, add them to the `network.allowed` list in your
workflow frontmatter:
>
> ```yaml
> network:
>   allowed:
>     - defaults
>     - "invalidhostthatdoesnotexist12345.com"
> ```
>
> See [Network
Configuration](https://github.github.com/gh-aw/reference/network/) for
more information.
>
> </details>


> Generated by [Go Logger
Enhancement](https://github.com/github/gh-aw-mcpg/actions/runs/24597333116/agentic_workflow)
· ● 8.4M ·
[◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw-mcpg+%22gh-aw-workflow-id%3A+go-logger%22&type=pullrequests)

<!-- gh-aw-agentic-workflow: Go Logger Enhancement, engine: copilot,
model: auto, id: 24597333116, workflow_id: go-logger, run:
https://github.com/github/gh-aw-mcpg/actions/runs/24597333116 -->

<!-- gh-aw-workflow-id: go-logger -->

Author: lpcox

internal/config/config_core.go

@@ -260,6 +260,8 @@ func applyGatewayDefaults(cfg *GatewayConfig) {
 	if cfg.KeepaliveInterval == 0 {
 		cfg.KeepaliveInterval = DefaultKeepaliveInterval
 	}
+	logConfig.Printf("Resolved gateway config after defaulting: port=%d, startupTimeout=%d, toolTimeout=%d, keepaliveInterval=%d",
+		cfg.Port, cfg.StartupTimeout, cfg.ToolTimeout, cfg.KeepaliveInterval)
 }
 
 // EnsureGatewayDefaults guarantees that cfg.Gateway is non-nil and that all
@@ -350,6 +352,7 @@ func LoadFromFile(path string) (*Config, error) {
 	// Note: map[string]interface{} fields (guard_policies, guards.*.config) are
 	// intentionally flexible and their nested keys are exempt from this check.
 	undecoded := md.Undecoded()
+	logConfig.Printf("Checking %d undecoded TOML keys against allowed fields", len(undecoded))
 	var unknownKeys []toml.Key
 	for _, key := range undecoded {
 		if !isDynamicTOMLPath(key) {
@@ -370,13 +373,21 @@ func LoadFromFile(path string) (*Config, error) {
 	}
 
 	// Validate TOML stdio servers use Docker for containerization (Spec Section 3.2.1)
+	stdioServerCount := 0
+	for _, serverCfg := range cfg.Servers {
+		if serverCfg.Type == "stdio" {
+			stdioServerCount++
+		}
+	}
+	logConfig.Printf("Validating stdio server containerization requirements for %d stdio servers", stdioServerCount)
 	if err := validateTOMLStdioContainerization(cfg.Servers); err != nil {
 		return nil, err
 	}
 
 	// Validate auth configs (e.g. fail-fast for missing OIDC env vars).
 	// This ensures parity with the JSON stdin path which calls validateServerAuth
 	// via convertStdinServerConfig → validateServerConfigWithCustomSchemas.
+	logConfig.Printf("Validating auth configuration for %d servers", len(cfg.Servers))
 	for name, serverCfg := range cfg.Servers {
 		jsonPath := fmt.Sprintf("servers.%s", name)
 		if err := validateServerAuth(serverCfg.Auth, serverCfg.Type, name, jsonPath); err != nil {
@@ -397,6 +408,7 @@ func LoadFromFile(path string) (*Config, error) {
 	// Merge opentelemetry key into tracing when present (spec §4.1.3.6).
 	// opentelemetry takes precedence over the legacy tracing key.
 	if cfg.Gateway.Opentelemetry != nil {
+		logConfig.Printf("opentelemetry section found: merging into tracing config (endpoint_set=%t)", cfg.Gateway.Opentelemetry.Endpoint != "")
 		cfg.Gateway.Tracing = cfg.Gateway.Opentelemetry
 		cfg.Gateway.Opentelemetry = nil
 		// Expand ${VAR} expressions in tracing fields before validation.