docs: add missing apiProxy CLI mappings and sync schema descriptions (#2759)

* docs: add missing apiProxy CLI mappings and sync schema descriptions

Add three apiProxy entries missing from the §5 CLI mapping table in
awf-config-spec.md:
- apiProxy.anthropicAutoCache → --anthropic-auto-cache
- apiProxy.anthropicCacheTailTtl → --anthropic-cache-tail-ttl
- apiProxy.models → config-only (model alias rewriting)

Sync src/awf-config-schema.json descriptions for apiProxy.enabled and
environment to match docs/awf-config.schema.json, which already
references §8–9 credential isolation and merge semantics.

Supersedes #2753.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Author: 3 people

docs/awf-config-spec.md

@@ -96,8 +96,11 @@ the corresponding CLI flag.
 - `network.upstreamProxy` → `--upstream-proxy`
 - `apiProxy.enabled` → `--enable-api-proxy`
 - `apiProxy.enableOpenCode` → `--enable-opencode`
+- `apiProxy.anthropicAutoCache` → `--anthropic-auto-cache`
+- `apiProxy.anthropicCacheTailTtl` → `--anthropic-cache-tail-ttl <5m|1h>`
 - `apiProxy.maxEffectiveTokens` → *(config-only; no CLI equivalent)*
 - `apiProxy.modelMultipliers` → *(config-only; no CLI equivalent)*
+- `apiProxy.models` → *(config-only; model alias rewriting)*
 - `apiProxy.targets.<provider>.host` → `--<provider>-api-target`
 - `apiProxy.targets.openai.basePath` → `--openai-api-base-path`
 - `apiProxy.targets.anthropic.basePath` → `--anthropic-api-base-path`

src/awf-config-schema.json

@@ -49,7 +49,7 @@
       "properties": {
         "enabled": {
           "type": "boolean",
-          "description": "Enable the API proxy sidecar container."
+          "description": "Enable the API proxy sidecar container. When enabled, source credentials (OPENAI_API_KEY, ANTHROPIC_API_KEY, COPILOT_GITHUB_TOKEN, COPILOT_API_KEY, GEMINI_API_KEY) are held exclusively in the sidecar and excluded from the agent environment. The agent receives proxy-routing base URLs instead. See docs/awf-config-spec.md §9 for credential isolation semantics."
         },
         "enableOpenCode": {
           "type": "boolean",
@@ -235,7 +235,7 @@
     },
     "environment": {
       "type": "object",
-      "description": "Environment variable propagation into the agent container.",
+      "description": "Environment variable propagation into the agent container. Variables are merged in precedence order: AWF-reserved (lowest) → envFile → envAll → CLI -e/--env (highest). When apiProxy.enabled is true, source credentials (OPENAI_API_KEY, ANTHROPIC_API_KEY, etc.) are excluded from the agent and held in the API proxy sidecar. See docs/awf-config-spec.md §8–9 for normative merge and credential isolation rules.",
       "additionalProperties": false,
       "properties": {
         "envFile": {