[log] Add debug logging to container detection in sys/container.go (#2598)

## Summary

Adds a package-level debug logger (`logSys`) and 4 meaningful debug log
calls to `internal/sys/container.go`, following the project's
`pkg:filename` naming convention from AGENTS.md.

## Changes

**File modified:** `internal/sys/container.go`

### What was added

1. Import for `github.com/github/gh-aw-mcpg/internal/logger`
2. Package-level logger variable: `var logSys =
logger.New("sys:container")`
3. Debug log at function entry: `"Detecting container environment"`
4. Detection method trace logs for each of the 3 detection paths:
   - `"Container detected via /.dockerenv"` (Method 1)
   - `"Container detected via /proc/1/cgroup"` (Method 2)
   - `"Container detected via RUNNING_IN_CONTAINER env var"` (Method 3)
5. Fallback log: `"No container indicators found, running on host"`

## Why this is useful

`IsRunningInContainer()` is a critical detection function used to
determine execution context and control security behavior (e.g., whether
direct command execution is permitted). When troubleshooting container
detection issues, developers had no visibility into which detection
method triggered (or why detection failed). With this change, running
`DEBUG=sys:* ./awmg --config config.toml` reveals exactly which method
fires.

## Quality checklist

- [x] Exactly 1 file modified
- [x] No test files modified
- [x] Logger declaration added following `pkg:filename` convention
(`sys:container`)
- [x] Log arguments are all string literals (no side effects)
- [x] Messages are meaningful and actionable for debugging
- [x] No duplicate logging with existing logs
- [x] Import statements properly formatted
- [x] Naming follows project convention (`logSys` matches `logConn`,
`logSchema`, etc.)




> Generated by [Go Logger
Enhancement](https://github.com/github/gh-aw-mcpg/actions/runs/23612565368)
·
[◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw-mcpg+%22gh-aw-workflow-id%3A+go-logger%22&type=pullrequests)

<!-- gh-aw-agentic-workflow: Go Logger Enhancement, engine: copilot,
model: auto, id: 23612565368, workflow_id: go-logger, run:
https://github.com/github/gh-aw-mcpg/actions/runs/23612565368 -->

<!-- gh-aw-workflow-id: go-logger -->

Author: lpcox

internal/sys/container.go

@@ -3,12 +3,19 @@ package sys
 import (
 	"os"
 	"strings"
+
+	"github.com/github/gh-aw-mcpg/internal/logger"
 )
 
+var logSys = logger.New("sys:container")
+
 // IsRunningInContainer detects if the current process is running inside a container.
 func IsRunningInContainer() bool {
+	logSys.Print("Detecting container environment")
+
 	// Method 1: Check for /.dockerenv file (Docker-specific)
 	if _, err := os.Stat("/.dockerenv"); err == nil {
+		logSys.Print("Container detected via /.dockerenv")
 		return true
 	}
 
@@ -20,14 +27,17 @@ func IsRunningInContainer() bool {
 			strings.Contains(content, "containerd") ||
 			strings.Contains(content, "kubepods") ||
 			strings.Contains(content, "lxc") {
+			logSys.Print("Container detected via /proc/1/cgroup")
 			return true
 		}
 	}
 
 	// Method 3: Check environment variable (set by Dockerfile)
 	if os.Getenv("RUNNING_IN_CONTAINER") == "true" {
+		logSys.Print("Container detected via RUNNING_IN_CONTAINER env var")
 		return true
 	}
 
+	logSys.Print("No container indicators found, running on host")
 	return false
 }