docs: subscription auth is the primary sandcastle flow, API key is fallback

.env.example

@@ -54,7 +54,22 @@ CMS_URL=http://localhost:3001
 
 # --- Optional: sandcastle dispatch (only when running `pnpm work dispatch --execute`) ---
 
+# Auth (pick one — subscription is preferred):
+#
+# 1. Subscription mode (recommended for Pro/Max subscribers):
+#    Run `claude login` on the host once. Sandcastle bind-mounts ~/.claude/
+#    into the sandbox so the container's Claude Code CLI uses your session.
+#    Zero per-task token spend. No env var needed.
+#
+# 2. API-key mode (fallback when no host creds available):
 # ANTHROPIC_API_KEY=
 # OPENAI_API_KEY=
+
+# Override the path to host Claude Code creds (default: ~/.claude/)
+# SANDCASTLE_CLAUDE_CREDS_DIR=
+
+# GitHub access (optional — for orchestrator-created PRs)
 # GITHUB_TOKEN=
+
+# Sandbox provider (default: docker; alternatives: podman, vercel, daytona)
 # SANDCASTLE_PROVIDER=docker