Fix GPT-5.4 findings: wrong env var name, Docker bearer token docs

- CHANGELOG.md: fix OPENSPACE_BEARER_TOKEN -> OPENSPACE_MCP_BEARER_TOKEN
- Dockerfile: document OPENSPACE_MCP_BEARER_TOKEN as REQUIRED, fix .env.example path

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: Brian Krafft

CHANGELOG.md

@@ -141,7 +141,7 @@ Key security improvements across the v2.0.0 release:
 - `mcp_server.py` is now a backward-compat shim — migrate to `openspace/mcp/` package
 - `evolver.py` is now a thin facade — migrate to `openspace/skill_engine/evolution/` package
 - `grounding_agent.py` replaced by `openspace/agents/grounding/` package
-- All MCP endpoints now require bearer token auth (set `OPENSPACE_BEARER_TOKEN`)
+- All MCP endpoints now require bearer token auth (set `OPENSPACE_MCP_BEARER_TOKEN`)
 - Cloud auto-import disabled by default (set `OPENSPACE_CLOUD_IMPORT=true` to re-enable)
 - E2B sandbox enforced by default for skill execution
 

Dockerfile

@@ -4,7 +4,8 @@
 # Build: docker build -t openspace .
 # Run:   docker run -p 8000:8000 --env-file .env openspace
 #
-# Environment variables (see .env.example):
+# Environment variables (see openspace/.env.example):
+#   OPENSPACE_MCP_BEARER_TOKEN (REQUIRED for HTTP transports)
 #   OPENSPACE_MCP_HOST, OPENSPACE_MCP_PORT, OPENSPACE_MCP_TRANSPORT,
 #   OPENSPACE_LOG_LEVEL, OPENSPACE_SHUTDOWN_TIMEOUT,
 #   OPENSPACE_METRICS_ENABLED, OPENROUTER_API_KEY, etc.