Clarify API proxy token protection in security architecture spec

[Copilot]

The security specification documented network isolation but didn't explicitly state that authentication tokens for AI engines are protected by the API proxy sidecar.

Changes

Section 6.8: Authentication Token Protection

• Added requirements NI-15, NI-16, NI-17 documenting API proxy token injection
• Engine processes never access tokens directly; proxy injects at request time
• Listed port numbers: Copilot (10002), Claude (10000), Codex (10001)

Test Coverage

• Added T-NI-010, T-NI-011, T-NI-012 for token protection verification
• Updated compliance checklist: Network Isolation now T-NI-001 through T-NI-012

Documentation Updates

• Updated security architecture diagram to show API proxy token protection
• Version bumped to 1.0.1 with change log entry

The specification now explicitly documents that COPILOT_GITHUB_TOKEN, ANTHROPIC_API_KEY, and OPENAI_API_KEY are injected by the proxy sidecar, not exposed to engine processes.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.