fix: add OSC_ENV derivation from OSC_MCP_URL and --env flag (#12)

[birme]

Summary

• Derives OSC_ENV from OSC_MCP_URL for dev/stage environment awareness
• Adds token refresh block matching web-runner pattern (x-pat-jwt header, jq parsing)
• Replaces legacy bare-eval config-to-env call with structured exit-code-checked block
• Filters only valid export VAR=val lines before eval to prevent shell injection
• Passes --env flag to config-to-env CLI call

Fixes #12

🤖 Generated with Claude Code