docs(orb): correct the anonymization-key description in .env.example (#1280)

The Orb exporter anonymizes with a dedicated, randomly-generated per-instance secret stored in system_flags (since #1257), not a key derived from the App private key. Corrects the .env.example TELEMETRY NOTICE prose to match the shipped code.

Author: JSONbored

.env.example

@@ -188,9 +188,10 @@ GITTENSORY_REVIEW_DRAFT=false
 #
 # WHAT IS SENT (per resolved PR, hourly): the gate verdict, the realized outcome (merged/closed), a reversal
 # flag, a bucketed reason category, and cycle time. NEVER sent: repo/owner/PR names, commit SHAs, code,
-# diffs, comments, or logins. Repo/PR identifiers are HMAC-anonymized with a DEDICATED key derived from YOUR
-# OWN App private key (GITHUB_APP_PRIVATE_KEY) — high-entropy and independent of your webhook secret, so even
-# gittensory (running the collector) can never de-anonymize them.
+# diffs, comments, or logins. Repo/PR identifiers are HMAC-anonymized with a DEDICATED, randomly-generated
+# per-instance secret created once and stored in your instance's own database (never your App private key or
+# webhook secret) — and the collector never holds it, so even gittensory (running the collector) can never
+# de-anonymize them.
 # The export carries no shared key; the collector treats it as untrusted, rate-limited, aggregate-only data.
 # ORB_AIR_GAP=false                          # air-gapped/OFFLINE deployments only: compute locally, never send
 # ORB_ANONYMIZE=true                         # HMAC-hash repo/PR before export (default true; false = raw names)