Use explicit octal perms and document best-effort GITHUB_ENV append

Agent-Logs-Url: https://github.com/github/gh-aw-mcpg/sessions/3bd624f8-e072-4062-b1f9-22dde46c5b34

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Author: Copilot

internal/cmd/proxy.go

@@ -334,7 +334,8 @@ func configureTLSTrustEnvironment(caCertPath string) error {
 		return nil
 	}
 
-	f, err := os.OpenFile(githubEnvPath, os.O_APPEND|os.O_WRONLY, 0644)
+	// Best-effort append: the proxy should still start even if GITHUB_ENV cannot be opened.
+	f, err := os.OpenFile(githubEnvPath, os.O_APPEND|os.O_WRONLY, 0o644)
 	if err != nil {
 		logger.LogWarn("startup", "Skipping GITHUB_ENV TLS trust export: open failed for %s: %v", githubEnvPath, err)
 		return nil

internal/cmd/proxy_test.go

@@ -436,7 +436,7 @@ func TestConfigureTLSTrustEnvironment(t *testing.T) {
 	t.Run("appends trust environment variables to GITHUB_ENV", func(t *testing.T) {
 		assert := assert.New(t)
 		githubEnvFile := t.TempDir() + "/github_env"
-		require.NoError(t, os.WriteFile(githubEnvFile, []byte{}, 0644))
+		require.NoError(t, os.WriteFile(githubEnvFile, []byte{}, 0o644))
 		t.Setenv("GITHUB_ENV", githubEnvFile)
 		for _, key := range tlsTrustEnvKeys {
 			t.Setenv(key, "")