Per-instance LLM provider/model override via env vars

## Problem

Multiple Orbit instances all read the same `~/.loom/config.json` and share `llm.active`. Switching providers in one window changes the active provider for every running instance — the second instance's agent restarts mid-analysis with the new model.

This blocks a common use case: running two analyses side-by-side with different models (e.g. expensive Sonnet for plan drafting in one window, cheap DeepSeek for mechanical execution in another).

## Proposed solution

Read environment variables in `buildSecretEnv()` (`app/src/main/agent.ts`) that override the active provider/model:

```bash
LOOM_LLM_PROVIDER=deepseek LOOM_LLM_MODEL=deepseek-v4-pro open -n /Applications/Orbit.app
```

### Resolution order (highest priority first)

1. `LOOM_LLM_PROVIDER` / `LOOM_LLM_MODEL` from `process.env` at Orbit launch
2. `cfg.llm.active` and `cfg.llm.providers[active].model` from `~/.loom/config.json`

The env-override path only changes which provider's stored key gets injected — it does NOT mutate the config file on disk. The Preferences UI continues to reflect what's saved in config; an info badge near the model name could show "overridden by env" so the user knows why their saved default isn't being used.

### Scope

- `app/src/main/agent.ts`: read `LOOM_LLM_PROVIDER` / `LOOM_LLM_MODEL` in `buildSecretEnv()`, fall back to config
- `app/src/main/main.ts`: pass overrides through to renderer for the model indicator
- `app/src/renderer/app.ts`: model indicator footer shows the override + a tooltip
- Documentation: brief note in the Orbit Hub page about parallel-instance usage

### Out of scope

- Per-window state isolation (window state, session JSONL paths) — those are already cwd-scoped, so different analysis directories naturally don't collide
- Per-instance API keys — the env override resolves to whatever key the named provider has in config; that's the right behavior

## Related

- Multiple-instance launch documented at https://help.galaxyproject.org/c/orbit-support/16 (no env-override support today)

Start in app/src/main/agent.ts at buildSecretEnv() and trace how the active provider and model are selected from process.env and ~/.loom/config.json. Then follow the override through app/src/main/main.ts and app/src/renderer/app.ts, including the model indicator footer, and update the Orbit Hub documentation. Done means the environment values take precedence without changing config on disk, the indicator explains the override, and the documented parallel-instance flow works.

Written by the indexing model from the issue text.