feat(onboarding): validate provider env placeholders

[typelicious]

What changed

• add provider env requirement collection for config placeholders used by provider stanzas
• extend foundrygate-doctor to warn about missing provider env values referenced in config.yaml
• cover the new env requirement reporting in onboarding tests and docs

Why

• surface missing provider env values before the first request or rollout
• make the new provider starter snippets more actionable in real local setup flows

How verified

• PYTHONPYCACHEPREFIX="/Users/andrelange/.codex/worktrees/257a/ClawGate/.pycache" python3 -m compileall foundrygate tests
• PYTHONPATH=. ./.venv-check-313/bin/pytest -q tests/test_onboarding.py
• ./.venv-check-313/bin/ruff check foundrygate/onboarding.py tests/test_onboarding.py README.md docs/ONBOARDING.md CHANGELOG.md
• bash -n scripts/foundrygate-doctor