fix(env): correct ANTHROPIC_API_KEY typo, add missing vars

The placeholder ANTHROPICS_API_KEY (with trailing S) silently failed:
the auth layer reads ANTHROPIC_API_KEY, so anyone copying .env.example
to .env and pasting their key would see gnoma never pick it up, with
no clear error.

Also surfaces vars that already work but weren't templated:
GOOGLE_API_KEY (alternative to GEMINI_API_KEY), GNOMA_PROVIDER and
GNOMA_MODEL (config overrides), and the two subprocess sandbox bypass
footguns (GNOMA_AGY_BYPASS_PERMISSIONS, GNOMA_CODEX_BYPASS_SANDBOX),
left commented out so they don't accidentally turn on.

.env.example

@@ -1,4 +1,15 @@
-MISTRAL_API_KEY="asd**"
-ANTHROPICS_API_KEY="sk-ant-**"
+# --- LLM provider keys (set at least one) ---
+ANTHROPIC_API_KEY="sk-ant-**"
 OPENAI_API_KEY="sk-proj-**"
 GEMINI_API_KEY="AIza**"
+# Alternative to GEMINI_API_KEY (either is accepted)
+# GOOGLE_API_KEY="AIza**"
+MISTRAL_API_KEY="**"
+
+# --- Optional overrides (config can also set these) ---
+# GNOMA_PROVIDER="anthropic"
+# GNOMA_MODEL="claude-sonnet-4-6"
+
+# --- Subprocess sandbox bypass (footguns — set deliberately) ---
+# GNOMA_AGY_BYPASS_PERMISSIONS=1
+# GNOMA_CODEX_BYPASS_SANDBOX=1