docs: clarify DIFC proxy flag wording

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/3d1c4bc9-2d27-4992-8793-cdafb4ec1fb4

Author: Copilot

docs-site/src/content/docs/reference/cli-reference.md

@@ -1076,7 +1076,7 @@ awf predownload [options]
 | `--image-tag <tag>` | string | `latest` | Container image tag (applies to squid, agent, agent-act, api-proxy, and cli-proxy images). Supports optional digest metadata — see [`--image-tag`](#--image-tag-tag) for format details. |
 | `--agent-image <value>` | string | `default` | Agent image preset (`default`, `act`) or custom image |
 | `--enable-api-proxy` | flag | `false` | Also download the API proxy image |
-| `--difc-proxy` | flag | `false` | Also download the CLI proxy image (for `--difc-proxy-host`) |
+| `--difc-proxy` | flag | `false` | Also download the CLI proxy image used when runtime flag `--difc-proxy-host` is set |
 
 :::tip
 After pre-downloading, use `--skip-pull` on subsequent runs to skip pulling images at runtime.

docs/usage.md

@@ -101,8 +101,8 @@ Options:
   --rate-limit-rph <n>         Max requests per hour per provider (requires --enable-api-proxy)
   --rate-limit-bytes-pm <n>    Max request bytes per minute per provider (requires --enable-api-proxy)
   --no-rate-limit              Disable rate limiting in the API proxy (requires --enable-api-proxy)
-  --difc-proxy-host <host:port> Connect to an external DIFC proxy (mcpg) and enable the CLI
-                               proxy sidecar for gh command routing
+  --difc-proxy-host <host:port> Connect to an external DIFC proxy (Multi-Cloud Proxy Gateway, "mcpg")
+                               and enable the CLI proxy sidecar for gh command routing
   --difc-proxy-ca-cert <path>  Path to TLS CA cert written by external DIFC proxy
   --ruleset-file <path>        YAML rule file for domain allowlisting (repeatable).
                                 Schema: version: 1, rules: [{domain, subdomains}]