docs: add missing subcommands to CLI reference (predownload, logs audit)

[Copilot]

CLI reference docs are missing awf predownload and awf logs audit subcommands.

Changes

• awf predownload — Added as top-level subcommand with options table (--image-registry, --image-tag, --agent-image, --enable-api-proxy) and usage examples
• awf logs audit — Added as logs sub-subcommand with options table (--format, --source, --rule, --domain, --decision), filter examples, and sample pretty output

Both sections follow the existing doc conventions (options tables, admonitions, code blocks). Content derived from src/cli.ts command definitions and src/commands/predownload.ts / src/commands/logs-audit.ts implementations.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• telemetry.astro.build
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node /home/REDACTED/work/gh-aw-firewall/gh-aw-firewall/docs-site/node_modules/.bin/astro build (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Pull request overview

Adds missing CLI reference documentation for two subcommands that exist in the codebase: awf predownload and awf logs audit.

Changes:

• Documented awf predownload with options table, usage, and examples.
• Documented awf logs audit with options table, filtering examples, and sample “pretty” output.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The intro sentence says subsequent runs can use --skip-pull to “avoid network calls”, but --skip-pull only avoids pulling container images; awf may still make other network requests depending on what’s executed inside the sandbox. Consider tightening this to “avoid pulling images at runtime” (or similar) to keep the claim accurate.

Suggested change

	Pre-download Docker images for offline use or faster startup. This pulls container images ahead of time so that subsequent `awf` runs can use `--skip-pull` to avoid network calls.
	Pre-download Docker images for offline use or faster startup. This pulls container images ahead of time so that subsequent `awf` runs can use `--skip-pull` to avoid pulling images at runtime.

[Copilot]

--agent-image here is documented as “preset … or custom image”, but the semantics for awf predownload differ from the top-level --agent-image section above (which describes custom base images requiring --build-local). For predownload, non-preset values are treated as a full image reference and are pulled as-is. Consider clarifying that difference (e.g., “preset (default, act) or explicit agent image reference”).

Suggested change

	| `--agent-image <value>` | string | `default` | Agent image preset (`default`, `act`) or custom image |
	| `--agent-image <value>` | string | `default` | Agent image preset (`default`, `act`) or explicit agent image reference |