Drop the VERIFY_TOKEN compat alias from sandbox env output

[ord669]

hookmyapp sandbox env (text and --json) now emits WEBHOOK_HMAC_SECRET as the only signing key and no longer duplicates it under VERIFY_TOKEN. The alias existed solely for starter-kits from before the verify-token/HMAC split; webhook-starter-kit v3 (hookmyapp/webhook-starter-kit#3) removed that fallback, so the alias has no remaining consumer. The sandbox tunnel never issues the verify-GET handshake, so nothing in the sandbox flow reads VERIFY_TOKEN at all.

channels env is unchanged — real channels still export a genuine VERIFY_TOKEN for the one-time webhook verification GET, which is a distinct concept from the HMAC signing secret.

Also updates the cross-repo drift test's canonical key list (verified against the merged kit main) and the README sandbox env samples. 920/920 tests, lint and tsc clean.

Tracked as AIT-126 in Linear.

Summary by CodeRabbit

• New Features

  • Sandbox environment files now use WEBHOOK_HMAC_SECRET for webhook signing.

• Bug Fixes

  • Removed the obsolete VERIFY_TOKEN entry from generated WhatsApp and Instagram sandbox environment files.
  • Updated JSON output and environment documentation to match the current sandbox configuration.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a3100146-d5cf-44b5-8bcd-5cd49c3989ae

📥 Commits

Reviewing files that changed from the base of the PR and between 16cf379 and cc7abd6.

📒 Files selected for processing (4)

• README.md
• src/__tests__/starter-kit-alignment.test.ts
• src/commands/sandbox/__tests__/env.test.ts
• src/commands/sandbox/env.ts

---

📝 Walkthrough

Walkthrough

The sandbox .env generator no longer emits VERIFY_TOKEN for WhatsApp or Instagram sessions. Tests, README examples, and the starter-kit canonical key check now expect only WEBHOOK_HMAC_SECRET.

Changes

Sandbox environment key update

Layer / File(s)	Summary
Remove VERIFY_TOKEN from sandbox generation src/commands/sandbox/env.ts, src/commands/sandbox/__tests__/env.test.ts	Sandbox environment builders omit the legacy alias, and dotenv and JSON expectations are updated for WhatsApp and Instagram sessions.
Align documentation and canonical keys README.md, src/__tests__/starter-kit-alignment.test.ts	Sandbox examples explain the absence of VERIFY_TOKEN, and the canonical environment key set uses WEBHOOK_HMAC_SECRET.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: removing the VERIFY_TOKEN compatibility alias from sandbox env output.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ait-126-drop-sandbox-verify-token-alias

---

_{Comment @coderabbitai help to get the list of available commands.}