refactor: consolidate guard policy env var names into constants, replace os.Getenv with envutil

[Copilot]

✨ Enhancement

The five guard-policy env var names were duplicated as string literals across flags_difc.go and guard_policy_parse.go, and guard_policy_parse.go mixed raw os.Getenv calls with envutil.GetEnvBool — inconsistent with the rest of the codebase.

What does this improve?

• Single source of truth for env var names — adding or renaming a variable is a one-line change
• Consistent envutil.GetEnvString/Bool usage throughout guard policy code

Implementation approach:

• New internal/config/guard_policy_env.go — five exported constants:

  const (
      EnvGuardPolicyJSON       = "MCP_GATEWAY_GUARD_POLICY_JSON"
      EnvAllowOnlyScopePublic  = "MCP_GATEWAY_ALLOWONLY_SCOPE_PUBLIC"
      EnvAllowOnlyScopeOwner   = "MCP_GATEWAY_ALLOWONLY_SCOPE_OWNER"
      EnvAllowOnlyScopeRepo    = "MCP_GATEWAY_ALLOWONLY_SCOPE_REPO"
      EnvAllowOnlyMinIntegrity = "MCP_GATEWAY_ALLOWONLY_MIN_INTEGRITY"
  )

• guard_policy_parse.go — replaced os.Getenv(...) with envutil.GetEnvString(Env..., ""), replaced string literals with constants, removed the os import
• flags_difc.go — replaced string literals with config.EnvXxx constants

[Copilot]

Pull request overview

Consolidates guard-policy environment variable handling by introducing shared constants and standardizing lookups through envutil, reducing duplication and improving consistency across config parsing and CLI flag defaults.

Changes:

• Added internal/config constants for guard-policy env var names.
• Updated guard policy override resolution to use envutil.GetEnvString/Bool and the new constants.
• Updated DIFC flag defaults to reference the shared env var constants.

Show a summary per file

File	Description
internal/config/guard_policy_parse.go	Uses shared env var constants and envutil helpers when resolving guard policy overrides from the environment.
internal/config/guard_policy_env.go	Introduces exported constants for guard-policy env var names as a single source of truth.
internal/cmd/flags_difc.go	Switches guard policy-related flag defaults to use config.Env* constants.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 3/3 changed files
• Comments generated: 0