[runtime] align env naming and analyze payload consistency

[GsCommand]

Motivation

• Reduce legacy environment alias surface and eliminate ignored vars in dev helpers by switching to canonical env names and a single legacy alias with a deprecation warning.
• Make CORS behavior configurable instead of hardcoding *.
• Normalize the analyze verb to accept the same object-shaped input.content as other verbs for consistent payload ergonomics.
• Preserve an inline fallback for shared schemas (boot/verification offline fallback) and document that decision.

Description

• Updated scripts/dev.sh to export the canonical signer env RECEIPT_SIGNER_ID and removed ignored CL_KEY_ID / CL_CANONICAL_ID exports.
• Reduced env alias chains in server.mjs to a canonical name plus one legacy alias for signer id, private key, and public key inputs, and added deprecation warnings when aliases are used via envAny/envAnySource.
• Added environment-configurable CORS via CORS_ALLOW_ORIGIN, CORS_ALLOW_HEADERS, and CORS_ALLOW_METHODS while preserving previous defaults when unset.
• Changed doAnalyze to expect body.input.content (object) instead of a raw string in body.input, and updated internal processing accordingly.
• Left BUILTIN_SHARED_SCHEMAS inline in server.mjs and added a short note in docs/CONFIGURATION.md documenting that it is an intentional offline/bootstrapping fallback.
• Updated docs/CONFIGURATION.md and SECURITY.md to reflect the new canonical env names, legacy alias behavior, and CORS configuration.
• Updated the smoke test (tests/smoke.mjs) to set canonical signer envs so the tests boot with the new narrowed alias surface.

Testing

• Ran npm test (unit tests via node --test runtime/tests/*.test.mjs and smoke tests node tests/smoke.mjs).
• All automated checks passed: unit tests (28) all passed and the smoke test succeeded (smoke ok).

---

Codex Task