Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/fern-docs-preview-comment.yml:
- Around line 46-84: The preview job currently runs fork-controlled Fern sources
with DOCS_FERN_TOKEN. Update the workflow condition governing the preview steps,
including the `Generate preview URL` path, to require that the workflow run
originates from a same-repository pull request before downloading artifacts,
installing the CLI, or invoking Fern; otherwise skip the job. Do not expose the
token to fork-provided inputs.

In @.github/workflows/publish-fern-docs.yml:
- Around line 62-65: Update the URL parsing block in the publish workflow to
fail explicitly when the published URL cannot be extracted from
/tmp/fern-output.log, instead of suppressing the grep failure or silently
skipping the summary. Preserve the existing GITHUB_STEP_SUMMARY output when a
URL is found.
- Around line 27-30: Update the release-triggered publish job to check out only
the canonical docs branch, or gate execution so non-current-version releases
cannot publish. In the Fern URL parsing step, validate that a published link was
emitted and explicitly fail the step when none is found, rather than allowing
the publish job to succeed silently.

In `@docs/1.2/usage.md`:
- Around line 140-142: Add the text language identifier to the fenced output
block containing “Enrollment succeeded” in docs/1.2/usage.md (lines 140-142),
and to the project-structure fenced block in docs/1.3/development.md (lines
33-52).
- Line 111: Correct the fleetint enroll command in the usage documentation by
inserting a space between the endpoint URL and the --token option, so they are
passed as separate arguments.
- Line 272: Update the metrics curl example in the usage documentation to
request the documented component name accelerator-nvidia-dcgm-thermal instead of
accelerator-nvidia-temperature.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/publish-fern-docs.yml:
- Around line 63-66: Update the shell setup in the workflow step that runs Fern
generation to use `set -euo pipefail` instead of only enabling pipefail,
ensuring a nonzero `fern generate` failure terminates the step before the URL
validation and success summary.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/publish-fern-docs.yml:
- Around line 44-47: Update the Checkout repository step in the release-publish
workflow to explicitly check out the canonical documentation branch or commit
instead of the release event ref. Preserve workflow_dispatch behavior as
appropriate, ensuring publishes always use the current fern/docs.yml rather than
potentially stale release-tag contents.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/fern-docs-ci.yml:
- Around line 105-106: Validate the .version value with the existing preview
workflow’s semver validation before installation, assign it to VERSION, and
install the exact package using the VERSION variable. Apply this change at
.github/workflows/fern-docs-ci.yml lines 105-106 and
.github/workflows/publish-fern-docs.yml lines 54-55.

In `@docs/1.2/configuration.md`:
- Around line 196-201: Update the Kubernetes verification commands in
docs/1.2/configuration.md lines 196-201 and docs/1.3/configuration.md lines
203-206 to use helm get values --all, ensuring both examples display chart
defaults and user overrides.
- Around line 104-107: Pin the Helm chart version in both installation examples:
update docs/1.2/configuration.md lines 104-107 to use --version 1.2.1, and
docs/1.3/configuration.md lines 109-114 to use --version 1.3.0, preserving the
existing command structure.

In `@docs/1.2/install-helm.md`:
- Around line 172-178: Update the DCGM troubleshooting commands near the
DCGM_URL environment check to use the configured $DCGM_URL for connectivity
testing instead of the hardcoded nvidia-dcgm.gpu-operator.svc:5555 endpoint.
Make the kubectl service lookup explicitly default-only or otherwise
configurable, preserving the documented custom env.DCGM_URL override behavior.

In `@docs/1.2/install-rpm.md`:
- Around line 80-84: Update the release link and package version placeholders in
the installation and update sections to target the documented 1.2 release line:
link to the v1.2.1 release and require a compatible 1.2.x RPM instead of using
the latest release or unconstrained VERSION.

In `@docs/1.2/usage.md`:
- Around line 304-313: The “Exposing the Agent for External Monitoring”
documentation uses an unsafe all-interfaces listener as the primary example.
Make 127.0.0.1:15133 the default example, retain a specific remote address only
with guidance to restrict access through a firewall or private network, and
document that remote scraping should use a TLS-authenticated reverse proxy
because the TCP API is unauthenticated plaintext HTTP.

In `@docs/1.3/configuration.md`:
- Around line 63-65: Update the configuration documentation around the
duration-valued environment variable descriptions to state that the table covers
both Fleet Intelligence settings and process-level environment tuning. Remove
MALLOC_ARENA_MAX from the telemetry exporter and runtime interval description,
and describe its glibc allocator behavior separately.

In `@docs/1.3/development.md`:
- Around line 33-52: Update the project-structure code fence in the
documentation to include the `text` language identifier after the opening
backticks, preserving the diagram contents unchanged.

In `@docs/1.3/install-helm.md`:
- Around line 36-44: Update the enrollment Secret creation instructions under
“Create enrollment secret” to avoid passing ENROLL_TOKEN via the kubectl command
line. Use a safer input mechanism that does not expose the token in process
arguments, while preserving the existing secret name, namespace, and token key
behavior.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/fern-docs-ci.yml:
- Around line 105-106: Validate the .version value with the existing preview
workflow’s semver validation before installation, assign it to VERSION, and
install the exact package using the VERSION variable. Apply this change at
.github/workflows/fern-docs-ci.yml lines 105-106 and
.github/workflows/publish-fern-docs.yml lines 54-55.

In `@docs/1.2/configuration.md`:
- Around line 196-201: Update the Kubernetes verification commands in
docs/1.2/configuration.md lines 196-201 and docs/1.3/configuration.md lines
203-206 to use helm get values --all, ensuring both examples display chart
defaults and user overrides.
- Around line 104-107: Pin the Helm chart version in both installation examples:
update docs/1.2/configuration.md lines 104-107 to use --version 1.2.1, and
docs/1.3/configuration.md lines 109-114 to use --version 1.3.0, preserving the
existing command structure.

In `@docs/1.2/install-helm.md`:
- Around line 172-178: Update the DCGM troubleshooting commands near the
DCGM_URL environment check to use the configured $DCGM_URL for connectivity
testing instead of the hardcoded nvidia-dcgm.gpu-operator.svc:5555 endpoint.
Make the kubectl service lookup explicitly default-only or otherwise
configurable, preserving the documented custom env.DCGM_URL override behavior.

In `@docs/1.2/install-rpm.md`:
- Around line 80-84: Update the release link and package version placeholders in
the installation and update sections to target the documented 1.2 release line:
link to the v1.2.1 release and require a compatible 1.2.x RPM instead of using
the latest release or unconstrained VERSION.

In `@docs/1.2/usage.md`:
- Around line 304-313: The “Exposing the Agent for External Monitoring”
documentation uses an unsafe all-interfaces listener as the primary example.
Make 127.0.0.1:15133 the default example, retain a specific remote address only
with guidance to restrict access through a firewall or private network, and
document that remote scraping should use a TLS-authenticated reverse proxy
because the TCP API is unauthenticated plaintext HTTP.

In `@docs/1.3/configuration.md`:
- Around line 63-65: Update the configuration documentation around the
duration-valued environment variable descriptions to state that the table covers
both Fleet Intelligence settings and process-level environment tuning. Remove
MALLOC_ARENA_MAX from the telemetry exporter and runtime interval description,
and describe its glibc allocator behavior separately.

In `@docs/1.3/development.md`:
- Around line 33-52: Update the project-structure code fence in the
documentation to include the `text` language identifier after the opening
backticks, preserving the diagram contents unchanged.

In `@docs/1.3/install-helm.md`:
- Around line 36-44: Update the enrollment Secret creation instructions under
“Create enrollment secret” to avoid passing ENROLL_TOKEN via the kubectl command
line. Use a safer input mechanism that does not expose the token in process
arguments, while preserving the existing secret name, namespace, and token key
behavior.