Refactor start.sh to allowlist .dev.vars generation

[heliosran]

Motivation

• Prevent leaking unrelated runtime/container environment variables into .dev.vars by generating only the app-required keys.
• Preserve manually managed credential files by skipping auto-generation when .dev.vars already exists.

Description

• Replace the broad env | while read ... export logic with an explicit allowlist of keys written to .dev.vars: OPENAI_API_KEY, OPENAI_CODEX_AUTH, CHATGPT_LOCAL_CLIENT_ID, CHATGPT_RESPONSES_URL, OLLAMA_API_URL, DEBUG_MODEL, and VERBOSE.
• Add prefix-based inclusion for optional REASONING_* variables via environment enumeration so reasoning controls are preserved when present.
• Skip generating .dev.vars if the file already exists and make the script stricter with set -euo pipefail.
• Update docs/docker.md to document the allowlist behavior and add CHATGPT_LOCAL_CLIENT_ID and OLLAMA_API_URL to the environment variable table; .dev.vars remains gitignored.

Testing

• Ran a shell syntax check with bash -n start.sh, which completed successfully.

---

Codex Task