Compiler does not propagate enterprise host into curated DIFC-proxy env on *.ghe.com

## Summary

On GitHub Enterprise Cloud **data-residency** tenants (`*.ghe.com`), the gh-aw compiler launches the mcpg **DIFC proxy** (via `actions/setup/sh/start_difc_proxy.sh`) with a **curated environment** that does not carry the enterprise GitHub host. As a result the proxy targets `github.com`/`api.github.com` instead of the tenant `*.ghe.com` API host, and `gh api` calls forwarded through it fail.

Downstream, the AWF firewall's `awf-cli-proxy` sidecar liveness probe fails with `diagnosis=unknown`, the firewall fails fast, and **the agent is never invoked**.

This is the gh-aw / compiler-side piece of github/gh-aw#41225.

## Environment

- gh-aw `v0.80.9`/`v0.81.2`; firewall `v0.27.7`/`0.27.9`; mcpg `v0.3.27`/`v0.3.29`
- Standard GitHub-hosted `ubuntu-24` runner
- GitHub Enterprise Cloud, **data residency** (`*.ghe.com`)
- `engine: copilot` (org-billed inference)

## Details

The reporter set workflow-level `GH_HOST` / `GITHUB_HOST` / `GITHUB_ENTERPRISE_HOST` to the enterprise host. These reach the AWF cli-proxy via `--env-all`, but **not** the DIFC proxy, because `start_difc_proxy.sh` builds its own curated env. So the proxy never learns the enterprise host.

This is closely related to github/gh-aw#21407 (compiler doesn't inject `GH_HOST`/telemetry for `*.ghe.com`).

## Proposed fix

1. Derive the enterprise host from `GITHUB_SERVER_URL` at compile/launch time.
2. Propagate it into the curated env passed to the DIFC proxy in `start_difc_proxy.sh` (e.g. `GH_HOST`, `GITHUB_API_URL`, tenant Copilot endpoint), so the proxy in github/gh-aw-mcpg can target the correct host.
3. Add data-residency coverage so `engine: copilot` on `*.ghe.com` is exercised.

## Acceptance

- On a `*.ghe.com` tenant, the DIFC proxy receives the enterprise host in its env.
- The forwarded `gh api rate_limit` returns 2xx, the AWF probe succeeds, and the agent runs.

## Companion issues

This is tracked across three repositories:

- **github/gh-aw#41911** — (this issue) compiler/env propagation: inject the enterprise host into the curated DIFC-proxy env
- **github/gh-aw-mcpg#8202** — DIFC proxy enterprise-host awareness (**root cause**)
- **github/gh-aw-firewall#5615** — `awf-cli-proxy` probe diagnostics: replace opaque `diagnosis=unknown` with the actual HTTP status/body

Original report: github/gh-aw#41225
Related: github/gh-aw#21407, github/gh-aw-firewall#1300