Allow AWF CLI proxy traffic to host DIFC port in gh-proxy workflows

[Copilot]

PR Sous Chef failed before agent startup because the AWF awf-cli-proxy sidecar could not reach the external DIFC proxy (host.docker.internal:18443). This change updates AWF host-port generation for tools.github.mode: gh-proxy so the CLI proxy path is permitted.

• Root cause addressed

  • In gh-proxy mode, AWF was launched with --difc-proxy-host host.docker.internal:18443 but host port allowlisting did not include 18443, causing sidecar startup failure.

• Compiler/AWF argument changes

  • Updated BuildAWFArgs to append 18443 to --allow-host-ports when GitHub CLI mode is enabled.
  • Preserved existing behavior for MCP gateway host ports and avoided duplicate 18443 when MCP port is already 18443.
  • Clarified logging text to reflect both MCP gateway and CLI proxy host access.

• Coverage updates

  • Added focused unit coverage for host-port composition in gh-proxy mode.
  • Updated the impacted wasm golden fixture (pi.golden) to match emitted AWF args.

# Before (gh-proxy workflows)
--allow-host-ports 80,443,8080 --difc-proxy-host host.docker.internal:18443

# After
--allow-host-ports 80,443,8080,18443 --difc-proxy-host host.docker.internal:18443

[pelikhan]

@lpcox