security: remove real API key from .env.example

Phase 4 complete: level2 dataset, distractor env, 90 tests passing

Phase 3: Dockerfile, openenv manifest, client, deployment guide, GRPO training notebook

Phase 2 complete: Level 1 env runs locally, tests green, 100-question dataset

Phase 1 complete: schemas, reward design, project scaffold