docs(network): fix ecosystem identifier list and topology-attach description

[github-actions]

Agent Documentation Update

Findings

Area	Issue	File(s)
accuracy	copilot-vendor ecosystem identifier exists in src/data/ecosystem_domains.json but was missing from the "Additional ecosystems" list	docs/network.md
accuracy	The --topology-attach description only documented the always-on MCPG attach (awmg-mcpg); it omitted the conditional second attach for the credential-isolated ado-proxy sidecar (awmg-ado-proxy) that src/compile/agentic_pipeline.rs emits on the Agent job when permissions.read is configured	docs/network.md

Applied Fixes

• Added copilot-vendor to the "Additional ecosystems" list
• Updated the AWF strict-topology paragraph to describe both --topology-attach invocations (MCPG always, ado-proxy conditionally) and cross-linked docs/ado-proxy-design.md

Notes

Verified against code:

• src/data/ecosystem_domains.json top-level keys (41 ecosystems) vs. the identifiers listed/tabulated in docs/network.md — copilot-vendor was the only gap.
• src/compile/agentic_pipeline.rs (topology_attach_block, MCPG_CONTAINER_NAME, ADO_PROXY_CONTAINER_NAME, and the test asserting 2 --topology-attach flags when ado-proxy is enabled) confirms the Agent job conditionally emits a second --topology-attach for the ado-proxy sidecar, which the doc previously omitted.

Checked open PRs for overlap: none of the currently open PRs touch docs/network.md; the recurring container_runtime.rs AGENTS.md PRs are unrelated to this change.

---

Created by the agent-documentation maintainer workflow.

Generated by Agent Documentation Maintainer · auto · 133.2 AIC · ⌖ 7.71 AIC · ⊞ 12.4K · ◷

[azure-pipelines]

Azure Pipelines:
2 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.