[WIP] Fix inaccuracies in CLI reference documentation

[Copilot]

Thanks for asking me to work on this. I will get started on it and keep this PR's description up to date as I form a plan and make progress.

---

This section details on the original issue you should resolve

<issue_title>docs: fix inaccuracies in CLI reference</issue_title>
<issue_description>## Summary

The CLI reference contains several inaccuracies that should be corrected.

Inaccuracies

1. --dns-servers default is wrong

• Docs say: Default is 8.8.8.8,8.8.4.4 (hardcoded Google DNS)
• Actual: Default is auto-detected from host resolvers via detectHostDnsServers() (added in PR feat: auto-detect host DNS resolvers instead of hardcoding Google DNS #1513). Falls back to Google DNS only if detection fails.

2. --keep-containers cleanup note references wrong container name

• Docs say: docker stop awf-squid awf-copilot
• Actual: Container is named awf-agent, not awf-copilot

3. --mount default mounts description is misleading

• Docs say: "host filesystem at /host (read-only)"
• Actual: AWF uses selective bind mounts, not a blanket host FS mount. System binaries (/usr, /bin, /sbin, /lib, /lib64, /opt, /sys, /dev) are mounted read-only; workspace and /tmp read-write; whitelisted $HOME subdirs read-write; select /etc files only (not /etc/shadow).

4. --allow-host-ports default description is outdated

• Docs say: "Current default allows all ports (future versions will default to 80,443)"
• Actual: Default is already 80,443 in the current code.</issue_description>

Comments on the Issue (you are @copilot in this section)