[log] feat(config): add debug logging to guard policy validation and parsing

[github-actions]

Summary

Adds logGuardPolicy debug log calls to four key functions in internal/config/guard_policy.go that previously had no logging, improving troubleshootability when guard policy configuration issues arise.

Changes

File: internal/config/guard_policy.go

Added 7 targeted debug log calls (reusing existing logGuardPolicy = logger.New("config:guard_policy")):

ValidateGuardPolicy

• Logs when policy is nil (clarifies the error path)
• Logs when delegating to write-sink validation, including acceptCount
• Logs when delegating to allow-only normalization

ValidateWriteSinkPolicy

• Logs acceptCount on entry for visibility into policy size
• Logs wildcard detection (["*"]) as a distinct valid path

ParseServerGuardPolicy

• Logs serverID and keyCount on entry to trace which server's policy is being parsed

ParsePolicyMap

• Logs detected format (hasAllowOnly, hasWriteSink) after key detection, distinguishing modern vs legacy policy map format

Why This Matters

These functions are the critical path for guard policy configuration parsing and validation. When a misconfigured policy causes startup failures, these log calls (enabled via DEBUG=config:guard_policy or DEBUG=*) will immediately surface:

• Which server's policy triggered the error
• Which policy type was detected
• Which validation branch was taken

Testing

• Single file modified: internal/config/guard_policy.go
• No test files modified
• Reuses existing logGuardPolicy logger — no new imports
• Logger arguments are all simple values (no side effects)
• No duplicate logging with existing calls

Generated by Go Logger Enhancement · ◷