docs: sync env-var contract (chaos panel, notion TLS, grok auth path) + repair glued VNC line

[diegosouzapw]

What

Fixes the check:env-doc-sync red on release/v3.8.49 (pre-existing drift, first surfaced on the docs-only PR #8348 -- the failing vars are unrelated to that change).

Root causes and fixes:

1. 7 vars referenced in code but undocumented -- now added to .env.example (commented, with defaults) and docs/reference/ENVIRONMENT.md:
   • OMNIROUTE_CHAOS_MAX_PANEL / OMNIROUTE_CHAOS_MIN_PANEL / OMNIROUTE_CHAOS_PANEL_TIMEOUT_MS -- Auto-Combo :chaos broadcast tuning (open-sse/services/autoCombo/virtualFactory.ts; the code comment explicitly says "operators can override via env var", so these are operator-facing, not allowlist material)
   • OMNIROUTE_NOTION_TLS_TIMEOUT_MS / OMNIROUTE_NOTION_TLS_GRACE_MS -- Notion TLS sidecar timeouts (notionTlsClient.ts / notion-web.ts), documented next to the CHATGPT/CLAUDE/PPLX/GROK siblings in section 15
   • GROK_AUTH_PATH -- Grok CLI auth.json path override read by grokQuotaFetcher.ts
2. OMNIROUTE_VNC_CONTAINER_VNC_PORT "missing" from .env.example -- it was actually there, but glued onto the previous entry on a single line (# OMNIROUTE_DOCKER_BIN=docker# OMNIROUTE_VNC_CONTAINER_VNC_PORT=3000), so the parser only saw the first var. Split into two lines. Also fixed the same glue typo in the Notion data-dir comment block (cosmetic).

No allowlist entries added -- all seven are documented for real.

Validation

node scripts/check/check-env-doc-sync.mjs on this branch:

  In code but missing from .env.example: none
  In .env.example but missing from ENVIRONMENT.md: none
  In ENVIRONMENT.md but missing from .env.example: none
  Env / docs contract is in sync.

(Red reproduced on the base tip before the fix -- same 8 findings as the CI run on #8348.)

[diegosouzapw]

CI outcome + base-red discrimination (all failures reproduced on the pure base tip 852bf4e0b0, i.e. without this PR's commit):

Check	Result	Verdict
Docs Gates (fast-path)	✅ pass	the gate this PR fixes (check:env-doc-sync) is green
Fast Quality Gates	❌	pre-existing: check:error-helper stale allowlist entry for open-sse/executors/muse-spark-web.ts (fails identically on base)
Vitest (fast-path)	❌	pre-existing: tests/unit/autoCombo/provider-family-combos.test.ts — auto/glm pool lost auggie (fails identically on base; likely interaction with #8240's family-fallback catalog filter)
Unit Tests fast-path 1-4	❌	pre-existing: failures span i18n drift (zh-TW/pt-BR/vi), APIKEY_PROVIDERS count, DashScope video, nvidia breaker classification, Notion thread continuity — 4 representative files re-run on the pure base fail identically

This PR's diff is inert by construction: every added .env.example line is a # comment or blank separator, plus two markdown table rows in docs/reference/ENVIRONMENT.md. The red checks belong to the current release/v3.8.49 tip and need their own reconciliation round.