Docs/fix stale references and env example

[Ranjithsingh2004]

Summary

Related issues

Type of change

• fix — bug fix
• feat — new feature
• docs — documentation only
• refactor / perf / test / chore / ci

Checklist

• npm run typecheck passes
• npm test passes
• npm run build compiles
• Added/updated tests for the change
• No secrets, real personal data, or local absolute paths in the diff
• PR title follows Conventional Commits

Notes for reviewers

[Bhasvanth-Dev9380]

Thanks for this, @Ranjithsingh2004 — stale-reference rot is exactly the kind of thing that goes unnoticed, so this is appreciated. I checked every change against the current tree; most of it is spot-on. A few things to sort before merge. 🦁

✅ Verified correct

• pi SDK references (@mariozechner/pi-* → @earendil-works/pi-*, 0.73.1 → 0.79.9) in AGENTS.md, skills/coding-agent/SKILL.md, and the run-main.ts comment — genuinely stale, correct fix. This is the valuable core of the PR.
• README channels (adding Slack / Discord / iMessage / BlueBubbles) — confirmed accurate: all six are registered in src/agents/channels/bundled-channel-metas.ts and have full implementations (slack 37, discord 57, imessage 27, bluebubbles 41 .ts files). The README really was stale.
• AGENTS.md F:\Brigade\ → brigade/ — good catch; removes an absolute path that AGENTS.md itself forbids.
• .env.example — 8 of the 9 vars verified present in src/ (BRIGADE_MODE, FORCE_MODE, STRICT_MODE, ENCRYPTION_KEY/_OLD/_FILE, CONVEX_URL, ENABLE_INBOX_PERSIST).
• media-path-guard.ts additions (encryption.key, admin-key.txt, .convex-data) — correct filenames (admin-key.txt matches convex-cmd.ts; encryption.key matches the other guards) and a genuine security hardening. Nice.

🔧 Please address before merge

1. Two code changes inside a "docs" PR.
src/core/server.ts and src/security/media-path-guard.ts are code, not docs.

• The media-path-guard.ts denylist additions are a real security improvement 👍 — but they (and the server.ts edit) would be better as a separate fix(security): … PR so history and review focus stay clean.
• src/core/server.ts removes "0.0.0.0/loopback-only" from LOCALHOST_BINDS. I verified it's inert — that exact string is never passed as a host anywhere (only prose comments elsewhere mention "loopback-only") — so it's harmless. But it's an undocumented behavioral-set edit with no test or rationale; please either call it out explicitly or drop it.

2. BRIGADE_HOST_ENV is itself stale.
The new .env.example block documents BRIGADE_HOST_ENV, but it exists nowhere in src/ — only in README.md. So this documents a non-functional variable. Please either wire it up or remove it from both .env.example and README.md. (It pre-existed in the README, so not introduced here — but a stale-reference pass is the right place to catch it.)

3. Fill the PR template + confirm CI.
The template is blank and the checklist is unticked. Since this touches src/, please confirm npm run typecheck, npm test, and npm run build are green, select the change type, and complete the checklist.

Once the above is sorted I'm happy to merge — thanks again for the cleanup!