docs: subscription auth is the primary sandcastle flow, API key is fallback

.sandcastle/.env.example

@@ -1,11 +1,20 @@
-# Anthropic Claude API
-ANTHROPIC_API_KEY=
+# .sandcastle/.env — runtime tokens for sandcastle dispatch.
+# Copy to .sandcastle/.env (gitignored) and fill what you need.
+#
+# Most developers don't need ANY of these if they've run `claude login` on
+# the host — sandcastle mounts ~/.claude/ into the sandbox by default.
 
-# OpenAI / Codex
-OPENAI_API_KEY=
+# Anthropic API key (fallback when no host Claude Code session exists)
+# ANTHROPIC_API_KEY=
 
-# GitHub (for PR creation by the orchestrator)
-GITHUB_TOKEN=
+# OpenAI / Codex (alternative)
+# OPENAI_API_KEY=
 
-# Sandcastle's own configuration — sandbox provider (docker | podman | vercel | custom)
+# GitHub access for orchestrator-created PRs
+# GITHUB_TOKEN=
+
+# Override Claude creds path (default: ~/.claude/)
+# SANDCASTLE_CLAUDE_CREDS_DIR=
+
+# Sandbox provider (docker / podman / vercel / daytona)
 SANDCASTLE_PROVIDER=docker