Hide enable-difc flag from public documentation (#864)

The `--enable-difc` flag needs to remain available for internal use but
should not be visible in public-facing documentation until ready for
general availability.

## Changes

- **`internal/cmd/flags_difc.go`**: Mark flag as hidden using Cobra's
`MarkHidden()` API
- **`README.md`**: Remove flag from CLI usage documentation

The flag remains fully functional via `--enable-difc` CLI argument or
`MCP_GATEWAY_ENABLE_DIFC` environment variable.

> [!WARNING]
>
> <details>
> <summary>Firewall rules blocked me from connecting to one or more
addresses (expand for details)</summary>
>
> #### I tried to connect to the following addresses, but was blocked by
firewall rules:
>
> - `example.com`
> - Triggering command: `/tmp/go-build2499327018/b275/launcher.test
/tmp/go-build2499327018/b275/launcher.test
-test.testlogfile=/tmp/go-build2499327018/b275/testlog.txt
-test.paniconexit0 -test.timeout=10m0s -test.v=true go --local
x_amd64/compile user.email` (dns block)
> - `invalid-host-that-does-not-exist-12345.com`
> - Triggering command: `/tmp/go-build2499327018/b260/config.test
/tmp/go-build2499327018/b260/config.test
-test.testlogfile=/tmp/go-build2499327018/b260/testlog.txt
-test.paniconexit0 -test.timeout=10m0s -test.v=true 64/src/runtime/cgo
ttp/httpguts/guts.go x_amd64/compile
credential.usern/opt/hostedtoolcache/go/1.25.6/x64/pkg/tool/linux_amd64/vet
1499997/b023/` (dns block)
> - `nonexistent.local`
> - Triggering command: `/tmp/go-build2499327018/b275/launcher.test
/tmp/go-build2499327018/b275/launcher.test
-test.testlogfile=/tmp/go-build2499327018/b275/testlog.txt
-test.paniconexit0 -test.timeout=10m0s -test.v=true go --local
x_amd64/compile user.email` (dns block)
> - `slow.example.com`
> - Triggering command: `/tmp/go-build2499327018/b275/launcher.test
/tmp/go-build2499327018/b275/launcher.test
-test.testlogfile=/tmp/go-build2499327018/b275/testlog.txt
-test.paniconexit0 -test.timeout=10m0s -test.v=true go --local
x_amd64/compile user.email` (dns block)
> - `this-host-does-not-exist-12345.com`
> - Triggering command: `/tmp/go-build2499327018/b284/mcp.test
/tmp/go-build2499327018/b284/mcp.test
-test.testlogfile=/tmp/go-build2499327018/b284/testlog.txt
-test.paniconexit0 -test.timeout=10m0s -test.v=true
ache/go/1.25.6/x64/src/runtime/c-p LaWt/B5k2ltHia24kziPLLaWt
x_amd64/vet` (dns block)
>
> If you need me to access, download, or install something from one of
these locations, you can either:
>
> - Configure [Actions setup
steps](https://gh.io/copilot/actions-setup-steps) to set up my
environment, which run before the firewall is enabled
> - Add the appropriate URLs or hosts to the custom allowlist in this
repository's [Copilot coding agent
settings](https://github.com/github/gh-aw-mcpg/settings/copilot/coding_agent)
(admins only)
>
> </details>

<!-- START COPILOT CODING AGENT TIPS -->
---

💡 You can make Copilot smarter by setting up custom instructions,
customizing its development environment and configuring Model Context
Protocol (MCP) servers. Learn more [Copilot coding agent
tips](https://gh.io/copilot-coding-agent-tips) in the docs.

Author: lpcox

README.md

@@ -273,7 +273,6 @@ Available Commands:
 Flags:
   -c, --config string                Path to config file
       --config-stdin                 Read MCP server configuration from stdin (JSON format). When enabled, overrides --config
-      --enable-difc                  Enable DIFC enforcement for information flow control
       --env string                   Path to .env file to load environment variables
   -h, --help                         help for awmg
   -l, --listen string                HTTP server listen address (default "127.0.0.1:3000")

internal/cmd/flags_difc.go

@@ -20,6 +20,7 @@ var (
 func init() {
 	RegisterFlag(func(cmd *cobra.Command) {
 		cmd.Flags().BoolVar(&enableDIFC, "enable-difc", getDefaultEnableDIFC(), "Enable DIFC enforcement for information flow control")
+		cmd.Flags().MarkHidden("enable-difc")
 	})
 }