Thanks for asking me to work on this. I will get started on it and keep this PR's description up to date as I form a plan and make progress.

---

This section details on the original issue you should resolve

<issue_title>docs: add environment variables section to CLI reference</issue_title>
<issue_description>## Summary

The CLI reference has no environment variables section. The CLI reads several env vars for auto-detection and credential management.

Missing environment variables

Auto-detection variables

Variable	Purpose
GITHUB_SERVER_URL	Auto-detects GHEC tenants (*.ghe.com) to add to domain allowlist
GITHUB_API_URL	Auto-detects GHEC API domains for allowlist
ENGINE_API_TARGET	Auto-detects GHES domains (e.g., api.github.mycompany.com)

API target overrides (also settable via CLI flags)

Variable	Default	Purpose
COPILOT_API_TARGET	api.githubcopilot.com	Copilot API endpoint override
OPENAI_API_TARGET	api.openai.com	OpenAI API endpoint override
OPENAI_API_BASE_PATH	-	OpenAI API base path (e.g., /serving-endpoints)
ANTHROPIC_API_TARGET	api.anthropic.com	Anthropic API endpoint override
ANTHROPIC_API_BASE_PATH	-	Anthropic API base path

Audit

Variable	Purpose
AWF_AUDIT_DIR	Fallback audit directory when --audit-dir not specified

Credential variables (used by API proxy sidecar)

Variable	Purpose
OPENAI_API_KEY	OpenAI API key — held securely in api-proxy sidecar
ANTHROPIC_API_KEY	Anthropic API key — held securely in api-proxy sidecar
COPILOT_GITHUB_TOKEN	GitHub Copilot token — held securely in api-proxy sidecar

These credentials are never exposed to the agent container when --enable-api-proxy is active.</issue_description>

Comments on the Issue (you are @copilot in this section)