docs(selfhost): preflight.ts's "ships EXACT literal placeholder" comment no longer matches .env.example for 4 of 5 named secrets

[JSONbored]

Context

src/selfhost/preflight.ts:80-90's comment justifying KNOWN_PLACEHOLDER_SECRETS claims .env.selfhost.example/.env.example "ship these EXACT literal placeholder values for high-privilege secrets (the webhook HMAC secret, plus the static API/MCP/internal bearer tokens)". Checked both files: GITHUB_WEBHOOK_SECRET, LOOPOVER_API_TOKEN, LOOPOVER_MCP_TOKEN, INTERNAL_JOB_TOKEN are all shipped blank/commented (# GITHUB_WEBHOOK_SECRET=), not with a literal placeholder string. Only SELFHOST_SETUP_TOKEN actually ships the literal change-this-long-random-value KNOWN_PLACEHOLDER_SECRETS guards against.

Requirements

• Update the comment to accurately describe the current state: only SELFHOST_SETUP_TOKEN ships a literal placeholder today; the other 4 ship blank/commented.
• Confirm KNOWN_PLACEHOLDER_SECRETS's actual runtime check still does something useful for the 4 blank-shipped vars (e.g. does it also catch an empty-string secret being used in production, which would be a different but still real problem?) — if the check has become effectively dead for those 4, note that in the PR rather than just fixing the comment.

Deliverables

• Comment accurately reflects current .env.example/.env.selfhost.example contents.
• A note (in the PR, not necessarily new code) on whether the check still does anything for the 4 blank-shipped secrets.

Expected Outcome

A reader of this comment isn't misled about which secrets actually ship exploitable literal defaults today.

Links & Resources

• src/selfhost/preflight.ts:80-90

[linear-code]

JSO-4370