mirror pull: --proxy-registry validates packages too late (fails mid-pull)

Summary

--proxy-registry does not validate the packages requirement up front. When packages are being pulled (not skipped) and no --include-package is given, the pull passes pre-run validation and then fails late, during the packages phase.

Details

• internal/mirror/cmd/pull/validation.go — validateProxyRegistryFlag enforces the --include-platform (platform) and --include-module@<constraint> (modules) requirements, but never considers packages.
• internal/mirror/packages/packages.go — in proxy mode, discoverPackageNames requires a whitelist and errors with --proxy-registry requires a whitelist of packages (--include-package).

So a command like:

d8 mirror pull /tmp/bundle --proxy-registry \
  --include-platform ">=1.64" \
  --include-module foo@^1.0.0

(packages left enabled, no --include-package) passes validation, does the platform/module work, and only then aborts in the packages phase.

Impact

Late failure after significant work, instead of an immediate, actionable validation error at startup.

Expected

Validate the packages requirement in validateProxyRegistryFlag — require --include-package (or --no-packages) when proxy mode pulls packages — symmetric with the existing modules/platform checks.

Severity: medium (UX). As of main (62132d6a).

Start in internal/mirror/cmd/pull/validation.go at validateProxyRegistryFlag, then compare the proxy-mode package behavior in internal/mirror/packages/packages.go. Confirm the existing platform and module validation flow and ensure package pulls require --include-package or --no-packages. Done means the example command fails during initial validation with an actionable error instead of during the packages phase.