feat: use step-scoped env for DIFC proxy instead of mutating GITHUB_ENV

- Remove GH_HOST, GITHUB_API_URL, GITHUB_GRAPHQL_URL, NODE_EXTRA_CA_CERTS,
  GH_AW_ORIGINAL_* writes from start_difc_proxy.sh
- Remove all GITHUB_ENV restore/clear logic from stop_difc_proxy.sh
- Add injectProxyEnvIntoCustomSteps() in compiler_difc_proxy.go that uses
  YAML parse+reserialize to add proxy env vars as step-level env on each
  custom step (preserving existing env vars like GH_TOKEN)
- Remove generateSetGHRepoAfterDIFCProxyStep() standalone step; GH_REPO
  is now included in the per-step env block
- Inject proxy env into custom steps in compiler_yaml_main_job.go when
  hasDIFCProxyNeeded returns true
- Update tests: replace TestBuildSetGHRepoStepYAML/TestGenerateSetGHRepo
  with TestProxyEnvVars/TestInjectProxyEnvIntoCustomSteps; update
  TestDIFCProxyStepOrderInCompiledWorkflow for new behavior
- Recompile 4 affected workflow lock files

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/c3114091-8d7b-4283-8647-91185fd5eb60

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Author: Copilot