fix(maestro): drop SHARED_ prefix from [shared] env vars

The shared section is the implicit global scope, so its fields use
the bare `MAESTRO_<FIELD>` env-var spelling. Only `[daemon]` and
`[registry]` sections get section-prefixed env vars.

Renames:
- MAESTRO_SHARED_TOKEN        → MAESTRO_TOKEN
- MAESTRO_SHARED_REGISTRY_URL → MAESTRO_REGISTRY_URL

`MAESTRO_DAEMON_*` and `MAESTRO_REGISTRY_BIND_ADDR` are unchanged.

This restores the canonical spec name (`MAESTRO_TOKEN`) that operators
already use in their deployment scripts — NAP-233 had renamed it to
`MAESTRO_SHARED_TOKEN`, which silently broke daemon auth against
existing registry deployments still setting `MAESTRO_TOKEN` in env.

Constants renamed alongside: `ENV_SHARED_TOKEN` → `ENV_TOKEN`,
`ENV_SHARED_REGISTRY_URL` → `ENV_REGISTRY_URL`. `EnvOverrides` fields
shed their `shared_` prefix to match.

Touches: daemon/cli/registry crates, e2e harness, design spec.

crates/maestro-cli/src/cli.rs

@@ -15,7 +15,7 @@ use uuid::Uuid;
 pub struct Cli {
     /// Override the registry URL for this invocation (e.g. `https://maestro.example.com`).
     /// If omitted, `[shared].registry_url` from the unified config file is used.
-    #[arg(long, global = true, env = "MAESTRO_SHARED_REGISTRY_URL")]
+    #[arg(long, global = true, env = "MAESTRO_REGISTRY_URL")]
     pub registry_url: Option<String>,
 
     /// Path to the unified Maestro config file. Default `~/.config/maestro/config.toml`.

crates/maestro-cli/src/config.rs

@@ -26,7 +26,7 @@ pub enum ConfigError {
     Inner(#[from] maestro_config::ConfigError),
     #[error(
         "no registry URL configured — pass --registry-url, set \
-         MAESTRO_SHARED_REGISTRY_URL, or run `maestro set-registry <url>`"
+         MAESTRO_REGISTRY_URL, or run `maestro set-registry <url>`"
     )]
     NoRegistryUrl,
 }