docs: improve clarity of DOCKER_HOST comments per review feedback

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/5c58cf57-cf73-4f3c-89b7-67261abd40d5

Author: Copilot

docs/environment.md

@@ -241,7 +241,7 @@ This overrides the socket used for AWF's own operations without affecting the ag
 
 ### Limitation
 
-The DinD TCP address (e.g., `tcp://localhost:2375`) typically refers to the runner's localhost from outside the container. From *inside* the agent container, `localhost` resolves to the container's own loopback interface, not the host's. To make docker commands inside the agent reach the DinD daemon you need one of:
+The DinD TCP address (e.g., `tcp://localhost:2375`) typically refers to the runner host's localhost interface. From *inside* the agent container, `localhost` resolves to the container's own loopback interface, not the host's. To make docker commands inside the agent reach the DinD daemon you need one of:
 
 - **`--enable-host-access`** — allows the agent to reach `host.docker.internal` and set `DOCKER_HOST=tcp://host.docker.internal:2375` inside the agent.
 - **`--enable-dind`** — mounts the local Docker socket (`/var/run/docker.sock`) directly into the agent container (only works when using the local daemon, not a remote DinD TCP socket).

src/types.ts

@@ -575,8 +575,8 @@ export interface WrapperConfig {
    *
    * When not set, AWF auto-detects the Docker host:
    * - If `DOCKER_HOST` is a Unix socket, it is used as-is.
-   * - If `DOCKER_HOST` is a TCP address (e.g. a DinD daemon), AWF clears it
-   *   and falls back to the system default socket.
+   * - If `DOCKER_HOST` is a TCP address (e.g. a Docker-in-Docker (DinD) daemon),
+   *   AWF clears it and falls back to the system default socket.
    *
    * The original `DOCKER_HOST` value (if any) is always forwarded into the
    * agent container so the agent workload can still reach the DinD daemon.