docs: update /docs for PRs merged 2026-06-18–20

[aheritier]

Updates documentation to reflect code changes from the last 36 hours (2026-06-18 12:00 UTC to 2026-06-20).

Changes per source PR:

• fix(modelinfo): offer the max effort tier in the Shift+Tab thinking cycle #3178 — Correct the Anthropic adaptive effort capability matrix in docs/guides/thinking/index.md; split Mythos preview into a separate column (max only, not xhigh); update Shift+Tab cycle description to include max for Opus 4.7+/Fable 5/Mythos 5. Update docs/providers/anthropic/index.md to add Sonnet 4.6 to the adaptive-thinking model list.

• feat(embeddedchat): add headless chat session API #3171 — Add "Headless Embedded Chat" section to docs/guides/go-sdk/index.md documenting the Config, Session, and Event types, Send/Confirm/Restart/Close API, and event-field reference table.

• feat(provider): make openai, anthropic, google, and amazon-bedrock optional #3176 — Add "Optional Provider Build Tags" section to the Go SDK guide covering docker_agent_no_{openai,anthropic,google,bedrock} and the Anthropic+Google dependency note.

• refactor(rag): make the rag toolset opt-in to drop cgo from embedders #3174 — Add "RAG Toolset (cgo-free builds)" section to the Go SDK guide explaining the blank-import requirement for cgo-free builds.

• Add lean TUI user setting #3181 — Add [Unreleased] entry to CHANGELOG.md (the TUI docs page was already updated by the source PR).

PRs not requiring doc changes: #3179 (changelog-only), #3175 (already added YAML anchors docs), #3177 (internal refactor), #3173 (internal bug fix), #3172 (internal refactor), #3170 (dependency bumps), #3169 (internal bug fix), #3166 (already added MCP timeout docs), #3163 (already added shell sudo_askpass docs), #3162 (internal bug fix).

[docker-agent]

Assessment: 🔴 CRITICAL

2 high-severity issues found in the new pkg/embeddedchat documentation:

1. Wrong approval scope in code example (ResumeApproveSession() vs ResumeApprove())
2. Wrong blank-import path for RAG toolset registration (pkg/rag does not register the toolset)

[docker-agent]

[HIGH] Wrong approval scope — ResumeApproveSession() should be ResumeApprove()

The comment says "Approve or reject the pending tool call" (a single call), but dagentruntime.ResumeApproveSession() approves all tool calls for the entire session — a blanket grant that bypasses every future confirmation prompt. This is a much broader permission than the example intends.

For approving only the currently pending tool call, use ResumeApprove():

if err := chat.Confirm(ctx, dagentruntime.ResumeApprove()); err != nil {
    return err
}

Use ResumeApproveSession() only when you explicitly want to suppress all remaining confirmations for the session (e.g. after the user clicks "allow all"). Using it here teaches developers an overly permissive pattern by default.

[docker-agent]

[HIGH] Wrong blank-import path for RAG toolset registration

The documented import _ "github.com/docker/docker-agent/pkg/rag" will not register the RAG toolset. The pkg/rag package is the cgo tree-sitter implementation library — it has no init() that calls teamloader.RegisterToolsetCreator.

The registration init() function lives in pkg/tools/builtin/rag/register.go. Blank-importing that package is what wires the "rag" toolset type into the teamloader registry:

import (
    _ "github.com/docker/docker-agent/pkg/tools/builtin/rag" // register RAG toolset
)

With the current import, a config declaring type: rag will still fail with "toolset type not registered" at startup — exactly the error the documentation promises this import will prevent.

[aheritier]

Addressed both HIGH-severity findings in commit 847f960:

Comment 1 (line 93 — wrong approval scope): Changed ResumeApproveSession() → ResumeApprove() in the embeddedchat confirmation example. ResumeApprove() approves only the currently pending call; the comment now notes that ResumeApproveSession() is appropriate when the user explicitly wants to allow all remaining confirmations for the session.

Comment 2 (line 165 — wrong RAG import path): Corrected the blank-import path from pkg/rag (the cgo library, no registration init) to pkg/tools/builtin/rag (contains register.go with the init() that calls teamloader.RegisterToolsetCreator("rag", ...)).