docs: fix 6 documentation discrepancies from nightly reconciliation report

[Copilot]

Six doc/code mismatches identified by the nightly reconciliation workflow — operators could misconfigure or misread guarantees based on the existing text.

README.md

• --otlp-sample-rate has no env-var fallback — unlike --otlp-endpoint (OTEL_EXPORTER_OTLP_ENDPOINT) and --otlp-service-name (OTEL_SERVICE_NAME), --otlp-sample-rate is CLI/config-only; clarified inline so operators don't expect MCP_GATEWAY_OTLP_SAMPLE_RATE to work.
• --config-stdin is enforced, not advisory — Cobra's MarkFlagsOneRequired("config", "config-stdin") makes this a hard requirement; updated note to say "The CLI requires either --config or --config-stdin".
• Schema-required fields phrasing — tightened from "schema-required fields" to explicitly name the required gateway object structure (port, domain, and one of agentId/apiKey).

CONTRIBUTING.md

• Go version — "Go 1.26.4 or later" → "Go 1.26.4"; only 1.26.4 is tested/pinned in go.mod and the Makefile.

• Container startup validation overstated — port-mapping check is conditional: skipped when container ID cannot be resolved or host networking is in use. Updated the bullet to reflect actual validate_port_mapping() behavior.

• JSON stdin example omits required gateway fields — the placeholder {"mcpServers": {...}} would fail schema validation immediately. Replaced with a minimal valid example:

  echo '{
    "gateway": {"port": 3000, "domain": "localhost", "agentId": "your-agent-id"},
    "mcpServers": {"github": {"type": "stdio", "container": "ghcr.io/github/github-mcp-server:latest"}}
  }' | ./awmg --config-stdin

• Fixes 📚 Documentation Reconciliation Report - 2026-07-24 #10028

[Copilot]

Pull request overview

Aligns operator and contributor documentation with current configuration and startup behavior.

Changes:

• Clarifies required configuration fields and CLI flags.
• Updates tracing, Go version, and container-validation guidance.
• Adds a valid JSON stdin example.

Show a summary per file

File	Description
README.md	Clarifies schema, CLI, and tracing configuration behavior.
CONTRIBUTING.md	Updates prerequisites, examples, and container validation details.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Medium

[lpcox]

@copilot address review feedback

[Copilot]

@copilot address review feedback

Addressed in a8f6174.

[github-actions]

🔒 mcpg Read-Only Stress — default AWF

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/list_prs/get_file/list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	Error [-32602]: unknown tool	BLOCKED	✅
C	CLI	reads (list_issues/get_file via github CLI)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh not authenticated	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh not authenticated	BLOCKED	✅

Overall: PASS

Notes:

• Part B: All 7 write tools rejected by gateway in ~32ms with Error [-32602]: unknown tool — gateway enforces read-only by not registering write tools.
• Parts D/E: gh CLI has no token in this runtime, so all REST/GraphQL write attempts fail at auth before reaching GitHub.

References: §30162477604

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/PRs/commits, get_file_contents)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	Error [-32602]: unknown tool	BLOCKED	✅
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh: GH_TOKEN not set (unauthenticated)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh: GH_TOKEN not set (unauthenticated)	BLOCKED	✅

Overall: PASS

Run: §30162477606

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	Error [-32602]: unknown tool (gateway-level)	BLOCKED	✅
C	CLI	reads (issues/file via github CLI)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	unauthenticated — gh has no GH_TOKEN	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	unauthenticated — gh has no GH_TOKEN	BLOCKED	✅

Overall: PASS

References: §30162477575

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime