[test] Add tests for proxy.restBackendCaller.CallTool (#3213)

## Test Coverage Improvement: `restBackendCaller.CallTool`

## Function Analyzed

- **Package**: `internal/proxy`
- **Function**: `(*restBackendCaller).CallTool`
- **File**: `internal/proxy/proxy.go`
- **Previous Coverage**: 0% for `pull_request_read`, `issue_read`,
`search_repositories`, and `default` branches
- **Complexity**: High — large switch statement with 5 cases, each with
nested type-coercion branches and error paths

## Why This Function?

`restBackendCaller.CallTool` is a 100+ line switch statement that
handles GitHub REST API routing for DIFC guard enrichment. The only
existing test (`collaborator_permission_test.go`) covered just one of
five cases. The remaining four branches — `pull_request_read`,
`issue_read`, `search_repositories`, and the `default` (unsupported
tool) case — had zero test coverage despite containing significant
logic:

- Type coercion for numeric IDs (`pullNumber`/`issue_number` as string
or float64 from JSON decoding)
- `perPage` defaulting logic for `search_repositories`
- Auth header selection (server token preferred over client auth, with
fallback)
- HTTP status ≥ 400 error translation
- MCP response envelope wrapping

## Tests Added

- ✅ `pull_request_read` — success with pullNumber as string
- ✅ `pull_request_read` — success with pullNumber as float64
(JSON-decoded number)
- ✅ `pull_request_read` — missing owner, repo, pullNumber (3 separate
cases)
- ✅ `pull_request_read` — empty pullNumber string with no float64
fallback
- ✅ `pull_request_read` — 404 from upstream API
- ✅ `issue_read` — success with issue_number as string
- ✅ `issue_read` — success with issue_number as float64
- ✅ `issue_read` — missing owner, repo, issue_number (3 cases)
- ✅ `issue_read` — empty issue_number with no float64 fallback
- ✅ `issue_read` — 404 from upstream API
- ✅ `search_repositories` — success with default perPage (10)
- ✅ `search_repositories` — success with custom perPage as float64
- ✅ `search_repositories` — missing query (absent key)
- ✅ `search_repositories` — empty query string
- ✅ `search_repositories` — 422 from upstream API
- ✅ `search_repositories` — query forwarding to upstream
- ✅ Unsupported tool names return "unsupported tool" error (6 names
including empty string)
- ✅ Invalid args type (non-map) returns "unexpected args type" for all
tool branches
- ✅ Auth: server `githubToken` preferred over `clientAuth`
- ✅ Auth: fallback to `clientAuth` when `githubToken` is empty
- ✅ Response format: MCP `{"content":[{"type":"text","text":"..."}]}`
envelope

## Test File

`internal/proxy/rest_backend_caller_tool_test.go` — follows the same
patterns as the existing `collaborator_permission_test.go` using
`httptest.NewServer` + `http.ServeMux`.

---
*Generated by Test Coverage Improver*
*Next run will target the next most complex under-tested function*




> Generated by [Test Coverage
Improver](https://github.com/github/gh-aw-mcpg/actions/runs/24000826256/agentic_workflow)
·
[◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw-mcpg+%22gh-aw-workflow-id%3A+test-coverage-improver%22&type=pullrequests)

<!-- gh-aw-agentic-workflow: Test Coverage Improver, engine: copilot,
model: auto, id: 24000826256, workflow_id: test-coverage-improver, run:
https://github.com/github/gh-aw-mcpg/actions/runs/24000826256 -->

<!-- gh-aw-workflow-id: test-coverage-improver -->

Author: lpcox