docs: fix typos in proposals (#30976)

docs/proposals/attach-debug-containers.md

@@ -87,7 +87,7 @@ see [PR](https://github.com/argoproj/argo-cd/pull/27124/changes)
 ### Risks and Mitigations
 
 * **Bigger attack surface than `exec`.** Debug container ships its own binaries — shells, package managers, net tools the workload image left out. `debug` grant = injecting arbitrary tooling into a live pod. Mitigation: off by default (`exec.debug.enabled`). Images limited to the `exec.debug.images` allowlist, RBAC supports per-image globs so a subject can be scoped tighter than the allowlist.
-* **Mutable image tags.** Allowlisting `busybox:latest` means the image pulled at attach time can change without ArgoCD approval — compromised upstream tag lands in prod. Mitigation: No mitigation in Argo itself, but docs will show a warning againts using mutable image tags.
+* **Mutable image tags.** Allowlisting `busybox:latest` means the image pulled at attach time can change without ArgoCD approval — compromised upstream tag lands in prod. Mitigation: No mitigation in Argo itself, but docs will show a warning against using mutable image tags.
 * **Resource exhaustion from a bad debug container.** Ephemeral containers share the pod's cgroup, and Kubernetes does not allow `resources` on ephemeral containers — so a profiler, packet capture, or fork bomb can't be bounded the way a sidecar can, and may starve the workload or fill node ephemeral storage. Mitigation: can't fix at the container level. Treat `exec.debug.images` as a trusted-image list and `debug` as a privileged grant on par with `exec`. Node-level protections (kubelet eviction thresholds, namespace ResourceQuotas on ephemeral storage) stay the operator's job.
 * **PID namespace sharing exposes the target's memory and FDs.** With shared PID namespace, the debug container can read `/proc/<pid>/mem`, `ptrace`, and see the workload's file descriptors — including in-memory secrets. Mitigation: opt-in per attach; audit log captures image + target container; same RBAC as `exec`.
 * **Debug history sticks around.** Kubernetes won't let you remove an ephemeral container once attached — the pod spec keeps the record until the pod is replaced. Called out in Non-Goals; UI shows `Sync OK (Debug Container Attached)` so the state isn't hidden.

docs/proposals/multiple-sources-for-applications.md

@@ -195,7 +195,7 @@ To allow multiple sources to the Application, we would add a new field `sources`
 
 To avoid complexity on the deciding the list of sources, if both `source` and `sources` fields are specified, we would override the source under `source` field with all the sources under `sources` field.
 
-**Depracating `source` field:** - Once the `sources` field is implemented in UI and cli as well, we will mark the `source` field as deprecated. At the same time, we will log `WARNING` messages and add UI blurbs about the deprecation. When maintainers feel confident about the adoption of the `sources` field, we will remove the `source` field from later releases.
+**Deprecating `source` field:** - Once the `sources` field is implemented in UI and cli as well, we will mark the `source` field as deprecated. At the same time, we will log `WARNING` messages and add UI blurbs about the deprecation. When maintainers feel confident about the adoption of the `sources` field, we will remove the `source` field from later releases.
 
 #### Invalidating existing cache