The old lookup resolved .env via __file__.parent.parent — that hits the
project root under `pip install -e .` but lands in site-packages/ under
pipx/PyPI, so LLMBASE_* vars were silently ignored and users saw
confusing downstream errors (wrong base_url, missing api_key, model not
found). Reported in #4.

New discovery order (first hit wins; shell exports still beat the file):

  1. $LLMBASE_ENV_FILE — explicit override, fail-closed on typo
  2. $PWD/.env — only when config.yaml declares llmbase-canonical paths
     (paths.concepts|wiki|raw). Prevents a stray config.yaml from an
     unrelated repo from qualifying CWD as a KB root and pulling in a
     hostile .env that could redirect LLMBASE_BASE_URL.
  3. ~/.config/llmbase/.env — user-level default, install-agnostic
  4. <package_parent>/.env — legacy editable-install path

Logs the resolved path at INFO so users can see what was loaded instead
of guessing.

Fixes #4

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>