fix: proxy response envelope preservation for GraphQL and search

Three bugs fixed:
1. copyResponseHeaders now copies Content-Type from upstream, fixing
   GraphQL passthrough where octokit couldn't parse the response
2. Search routes now pass the 'q' query param as 'query' arg to the
   guard, enabling proper repo-scoped integrity labels
3. REST search responses are re-wrapped in the original envelope
   ({total_count, items}) after filtering. GraphQL responses with
   filtered items are reconstructed preserving the {data:{...}} tree

Smoke workflow updated to build from source (docker build) instead
of pulling a published image, so we can test unreleased fixes.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: lpcox

.github/workflows/smoke-proxy-github-script.lock.yml

@@ -23,6 +23,7 @@ network:
     - defaults
     - github
     - github.com
+    - rust
 tools:
   agentic-workflows:
   cache-memory: true
@@ -44,9 +45,23 @@ sandbox:
   mcp:
     container: "ghcr.io/github/gh-aw-mcpg"
 steps:
-  # ── Pull the gateway container image ───────────────────────────────
-  - name: Pull MCP Gateway image
-    run: docker pull ghcr.io/github/gh-aw-mcpg:v0.2.2
+  # ── Build the gateway container image from source ──────────────────
+  - name: Build MCP Gateway image
+    run: |
+      # Install Rust and WASM target if not present
+      if ! command -v rustup &>/dev/null; then
+        curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
+        source "$HOME/.cargo/env"
+      fi
+      rustup target add wasm32-wasip1
+
+      # Build the Rust WASM guard (required by Dockerfile)
+      cd guards/github-guard/rust-guard
+      bash build.sh
+      cd ../../..
+
+      # Build Docker image
+      docker build -t awmg-local:latest .
 
   # ── Start the DIFC proxy ──────────────────────────────────────────
   - name: Start DIFC proxy
@@ -66,7 +81,7 @@ steps:
         -e DEBUG='*' \
         -v "$PROXY_LOG_DIR:$PROXY_LOG_DIR" \
         -v "$MCP_LOG_DIR:$MCP_LOG_DIR" \
-        ghcr.io/github/gh-aw-mcpg:v0.2.2 proxy \
+        awmg-local:latest proxy \
           --policy "$POLICY" \
           --listen 0.0.0.0:18443 \
           --log-dir "$MCP_LOG_DIR" \
@@ -393,7 +408,7 @@ Pre-agent steps ran 6 tests through `actions/github-script@v8` with
 ## Proxy + github-script Smoke Test Results
 
 **Policy**: repos=["github/gh-aw-mcpg"], min-integrity=approved
-**Proxy**: ghcr.io/github/gh-aw-mcpg:v0.2.2, port 18443, HTTP, filter mode
+**Proxy**: awmg-local:latest (built from source), port 18443, HTTP, filter mode
 **Run**: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
 
 ### REST API Tests