docs: add CLI and operator environment variable reference

[Copilot]

CLI-side and operator-facing environment variables were only discoverable by grepping source code — no user-facing reference existed for debug logging, model overrides, or guard policy fallbacks.

Changes

reference/environment-variables.md — three new sections inserted after "System-Injected Runtime Variables":

• CLI Configuration Variables — DEBUG, DEBUG_COLORS, ACCESSIBLE, NO_COLOR, GH_AW_ACTION_MODE, GH_AW_FEATURES, GH_AW_MAX_CONCURRENT_DOWNLOADS, GH_AW_MCP_SERVER; includes a debug logging quick-reference
• Model Override Variables — all GH_AW_MODEL_AGENT_* and GH_AW_MODEL_DETECTION_* vars split by phase, with a note that engine.model: in frontmatter takes precedence; documents the org-variable pattern for setting org-wide defaults
• Guard Policy Fallback Variables — GH_AW_GITHUB_BLOCKED_USERS, GH_AW_GITHUB_APPROVAL_LABELS, GH_AW_GITHUB_TRUSTED_USERS, mapped to their tools.github.* frontmatter counterparts with format and precedence notes

Also:

• Page description frontmatter updated to reflect expanded scope
• Related Documentation gains Engines and Tokens links; Tools entry updated to mention guard policies
• tokens.md Related Documentation cross-reference updated to point specifically to the new CLI, model override, and guard policy sections

[glitch-ux]

Thanks for picking this up! Would you mind adding a co-author credit? :) @pelikhan

[pelikhan]

I don't know how to do that. You will be picked up in the contributor list in the release notes

[Copilot]

Pull request overview

Adds a user-facing reference for gh aw CLI, model override, and guard policy-related environment variables, expanding the existing environment variable precedence documentation and cross-linking it from Tokens.

Changes:

• Documented CLI configuration env vars (debug logging, accessibility/color controls, download concurrency, action mode, features).
• Documented model override env vars for agent and detection phases, with links to Engines and org-variable usage.
• Documented guard policy env vars and updated related documentation links (including Tokens cross-references).

Show a summary per file

File	Description
docs/src/content/docs/reference/environment-variables.md	Expands env var reference with CLI/model/guard-policy sections and refreshes Related Documentation links.
docs/src/content/docs/reference/tokens.md	Updates Related Documentation blurb to point readers to the expanded env var reference scope.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 1

[Copilot]

The Guard Policy section says these variables are only used as fallbacks when tools.github.* is absent and that explicit frontmatter values “always take precedence”. In the current implementation, compiler_github_mcp_steps.go always passes the ${{ vars.GH_AW_GITHUB_* }} values into parse_guard_list.sh, which merges them with any compile-time tools.github.* lists (via GH_AW_*_EXTRA). That means org/repo variables still apply even when frontmatter specifies values, rather than being ignored.

Please update this section to describe the merge behavior (and any opt-out semantics, if intended), rather than precedence/fallback-only behavior.

Suggested change

	## Guard Policy Fallback Variables
	These variables provide fallback values for guard policy fields when the corresponding `tools.github.*` configuration is absent from workflow frontmatter. Set them as GitHub Actions organization or repository variables to enforce a consistent policy across all workflows.
	> [!NOTE]
	> Explicit `tools.github.*` values in workflow frontmatter always take precedence over these variables.
	## Guard Policy Variables
	These variables let you define organization- or repository-level guard policy lists for GitHub-related checks. They can be set as GitHub Actions organization or repository variables to enforce a consistent baseline policy across workflows.
	> [!NOTE]
	> When both these variables and the corresponding `tools.github.*` frontmatter fields are set, their values are merged into the effective guard policy. Frontmatter values do not automatically suppress organization/repository values. If you need to opt out of inherited guard entries, use the tool-specific mechanism documented in the [Tools Reference](/gh-aw/reference/tools/).