docs(env-json): align skill with released CLI 3.7.0 behavior

[xergioalex]

Summary

CLI 3.7.0 is now live on PyPI with the .dailybot/env.json per-repo auth feature. This PR closes the last documentation gaps between the skill pack and the released guard/loader behavior, verified live against the shipped CLI, so an agent following this skill never meets an undocumented edge.

What changed

skills/dailybot/shared/env-json.md

• § Security — refuse-if-tracked guard: documents that staged-but-uncommitted counts as tracked (git ls-files reads the index), the two exact carve-outs (--help/--version Click short-circuit, and the hook group printing the error to stderr while still running and exiting 0 per its always-exit-0 harness contract), and the loud-warning degradation when the git binary is missing but a .git ancestor exists.
• § Security — 0o600: upgraded to created-with-0o600-from-the-first-byte (os.open, no umask window) + defensive re-chmod on load.
• Schema table — disabled must be a JSON boolean: a hand-edited "true" string warns loudly and the file stays active (use dailybot env off).
• § CLI workflow — env show prints an explicit Disabled: no row and resolves defaulted API/Webapp URLs.
• § Troubleshooting — parse warnings go to stdout (not stderr), once per process; new entries for the disabled-string typo and hook-under-guard behavior.

skills/dailybot/env/SKILL.md — quick-reference troubleshooting mirrors the three new facts (staged-counts, hook exit-0, disabled-string).

Verification

• Every documented behavior was exercised live against the released CLI (guard with staged and committed file, hook exit codes, disabled-string warning, env show output, wire preference).
• The 3.7.0 changelog contains exactly PR feat(env): add .dailybot/env.json per-repo API key override cli#69 — no other release content needed documenting.
• scripts/validate-frontmatter.py: all 16 SKILL.md files pass.

🤖 Generated with Claude Code