Adds a "Configuration env vars" section listing every RELICARIO_* variable read by production code, with purpose and trust boundary. Splits user-facing vars from debug-only ones (cfg(debug_assertions)) to make the attack surface explicit for security reviewers. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>