bug: env vars silently override .cora.yaml config without warning

[ajianaz]

Description

When CORA_PROVIDER, CORA_BASE_URL, or CORA_API_KEY env vars are set (e.g. from a parent process), they silently override .cora.yaml and ~/.cora/config.yaml settings. There is no warning or log message indicating this override.

Impact

• Users set provider: zai in config but cora uses OpenAI because CORA_PROVIDER=openai is in env
• cora config show displays the config file values, not the actual resolved values from env vars
• Debugging is extremely difficult — only RUST_LOG=debug reveals the actual URL being used

Expected Behavior

• Show warning when env vars override config: ⚠️ CORA_PROVIDER=openai overrides config provider=zai
• cora config show should display resolved (effective) config, not just file contents

Reproduction

# .cora.yaml has provider: zai
export CORA_PROVIDER=openai
cora review --diff-file test.patch  # silently uses openai, not zai

[ajianaz]

Partially fixed by PR #210, #211:\n\n- ✅ cora config show now displays effective resolved config with source annotations ([from: env CORA_PROVIDER])\n- ✅ No longer silent — users can see exactly where each value comes from\n\nThe env var override behavior is by design (CI needs it). The fix is visibility — config show now makes overrides obvious.