Log reflect responses for detection debugging

[davidslater]

Adds an opt-in debug path for printing raw /reflect responses during detection-only troubleshooting.

Summary:

• enables THREAT_DETECTION_LOG_REFLECT_RESPONSE in the detection-only workflow
• prints grouped GET/POST /reflect responses from the Go reflect client when the env var is true
• documents the debug env var and its artifact-content risk
• adds unit coverage for the logging helper, including the isolated enabled/disabled buffer phases

Verification:

• gofmt -w pkg/engine/reflect.go pkg/engine/reflect_test.go
• git diff --check
• go test ./pkg/engine