captureEnvTokenHost boot snapshot

Chose a boot-time environment-token host snapshot over consulting .sentryclirc because configuration files have weaker integrity than environment configuration or the issuing server’s embedded claim. captureEnvTokenHost() resolves the normalized sntrys_ url claim first, then SENTRY_HOST, then SENTRY_URL, then Sentry SaaS; later .sentryclirc mutations must never influence that trust anchor.