@edgehero/pi-dispatch v1.10.2

The .env.example this package ships now names the configuration it reads. That file is not documentation on the side: pi-dispatch init copies it verbatim into a new deployment, so it is the whole of what an operator can learn this system accepts, and a variable missing from it is one nobody can find.

Twenty-six variables were read by the code and named in no .env.example, no README and no docs page. Nine are now keys here:

• GITHUB_PAT_VAR, which variable actually holds the PAT. The name is read verbatim and checked against nothing, so pointing it at a variable holding something else would send that value to GitHub as a token.
• GITLAB_AUTH_SOURCE, FORGEJO_AUTH_SOURCE, AZURE_AUTH_SOURCE, one value each, pat, which is also the default. They exist to refuse a wrong assumption of symmetry with GITHUB_AUTH_SOURCE, and the refusal needs that forge's own token to be set.
• POLL_REPOS and POLL_INTERVAL_SECONDS for the poller, plus PI_CODING_AGENT_DIR, PI_GRAPH_DIR and PI_DISPATCH_DEPLOYMENT_FILE.

The other seventeen carry a comment at their own read site saying why they cannot be keys, and the file closes with the accounting: every variable that is not a key, with its reason. REQ-DEPLOYMENT-BOOTSTRAP states the rule and a test enforces it, so the gap cannot reopen quietly.

Upgrading: npm install. No service reinstall. init never overwrites an existing .env, so to pick up the new commentary in your own file, diff it against the .env.example in this package.

Worth knowing if you run Google models: doctor accepts GOOGLE_API_KEY for PI_PROVIDER=google and accepts gemini as a provider name. pi reads neither, so both pass the preflight and then refuse every job before spending anything. Issue #286, not fixed in this release.