Rename wizard env vars to WIZARD_ prefix

[gewenyu99]

POSTHOG_PERSONAL_API_KEY -> WIZARD_API_KEY and POSTHOG_WIZARD_* -> WIZARD_* across services, .env.example, README, fresh-setup, and the CI workflow, matching the wizard's renamed env vars. GH_APP_* secret names are unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com

[gewenyu99]

• Rename wizard env vars to WIZARD_ prefix #1788 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[gewenyu99]

Matching wizard PR: PostHog/wizard#603 — Tidy wizard env vars: WIZARD prefix, ignore in prod builds_

This PR mirrors the env-var rename landing in the wizard repo (same fix/tidy-env-var branch). Relevant changes from #603 that this workbench PR needs to stay in sync with:

Renames

• Prefix change: every POSTHOG_WIZARD_* option env var → WIZARD_* (WIZARD_DEBUG, WIZARD_SIGNUP, WIZARD_INSTALL_DIR, WIZARD_CI, WIZARD_PROJECT_ID, WIZARD_REGION, WIZARD_LOCAL_MCP, WIZARD_TELEMETRY/WIZARD_NO_TELEMETRY, WIZARD_EMAIL, WIZARD_NAME, WIZARD_BENCHMARK*, WIZARD_LOG_DIR, WIZARD_YARA_REPORT).
• POSTHOG_PERSONAL_API_KEY → WIZARD_API_KEY. This is now the single key the --api-key flag reads, and the .env / .env.local lookup in src/utils/env-api-key.ts matches ^WIZARD_API_KEY=.
• POSTHOG_PROJECT_ID → WIZARD_PROJECT_ID.
• POSTHOG_API_KEY (MCP subprocess auth) dropped from the runtime allowlist.

Behavior change worth knowing

• WIZARD_* vars are now dev/CI-only. In published builds (IS_PRODUCTION_BUILD), runtimeEnv() and the yargs option defaults ignore all WIZARD_* keys, so the shipped npm package can't be reconfigured through them. The old blanket .env('POSTHOG_WIZARD') yargs prefix is gone, replaced by explicit per-option wizardEnvDefault() / wizardEnvBool() helpers in src/env.ts. Workbench CI runs against source (not a prod build), so these still take effect there.

CI / secrets

• The GitHub Actions secret name is unchanged (GH_APP_POSTHOG_WIZARD_CI_BOT_POSTHOG_PERSONAL_KEY); only the env var it's assigned to changed (POSTHOG_PERSONAL_API_KEY: → WIZARD_API_KEY:). Matches the GH_APP_* note in this PR's description.

Merge order: land #603 (or at least confirm the names) before/with this so the workbench and the wizard agree on the env vars.