Add security architecture slides to presentation deck

[Copilot]

Adds 10 slides covering the multi-layered defense architecture to the Marp presentation deck.

Content Added

• Architecture diagram: Mermaid flowchart visualizing sandboxed agent, MCP gateway, containerized tools, and proxy/firewall layers
• Security layers breakdown: Agent sandbox, MCP gateway routing, tool isolation, service access controls
• Operational guidance: Strict mode enforcement, manual approval gates, plan/check/act pattern

Technical Details

Each security layer is explained with specific controls:

• Layer 1: Agent in isolated sandbox with read-only permissions, primary firewall
• Layer 2: MCP Gateway (mcpg) validates tool invocations, enforces permission boundaries
• Layer 3: Per-tool sandboxes with non-root UIDs, dropped capabilities, secondary firewalls
• Layer 4: Multi-proxy defense before external service access

Content sourced from /docs/src/content/docs/guides/security.md and compiled via Marp to /docs/dist/slides/index.html (129KB).

Example Slide Content

---
strict: true
permissions:
  contents: read
network:
  allowed: [defaults, python]
safe-outputs:
  create-issue:
---

Strict mode enforces: no write permissions (use safe-outputs), secure network defaults, no wildcard domains, SHA-pinned actions.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• telemetry.astro.build
  • Triggering command: /opt/hostedtoolcache/node/24.13.0/x64/bin/node node /home/REDACTED/work/gh-aw/gh-aw/docs/node_modules/.bin/astro build (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Add a slides on security architecture (see security architecture docs)

Custom agent used: technical-doc-writer
AI technical documentation writer for GitHub Actions library using GitHub Docs voice

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.