fix(deploy): pass NATS_HOST/NATS_PORT and autonomy gates through compose

The agents connect with NATS_HOST/NATS_PORT (NATS_URL is informational), but
docker-compose only forwarded NATS_URL. That was masked while system_config
carried the real host as a hardcoded default; after the secrets scrub the
default is localhost, so a deploy would have sent every NATS connection —
message bus, DispatchAgent, ExceptionAgent — to localhost.

Also forwards the autonomy gates (all default false) plus DISPATCH_REALERT_EVERY
and LLM_MODEL, so production behaviour is set in .env rather than by code
defaults. .env.example updated to match.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012AJLYcbTHCe45fyFnMfEin

.env.example

@@ -1,5 +1,7 @@
 GO_API_BASE_URL=
 NATS_URL=
+NATS_HOST=
+NATS_PORT=4222
 REDIS_HOST=
 REDIS_PORT=
 REDIS_PASSWORD=
@@ -14,3 +16,10 @@ NATS_PASSWORD=
 ANTHROPIC_API_KEY=
 LLM_MODEL=claude-opus-4-8
 LOG_LEVEL=INFO
+
+# Autonomy gates — outward-facing/irreversible actions are off unless enabled
+DISPATCH_AGENT_AUTONOMOUS=false
+EXPRESS_AGENT_AUTONOMOUS=false
+EXCEPTION_AGENT_AUTONOMOUS=false
+# Re-alert cadence during a failure burst in one zone
+DISPATCH_REALERT_EVERY=100