Getting Started: behavior-changing environment variables are not documented on the page

[trevor-vaughan]

Summary

Two environment variables change complyctl's behavior — including one with a network side
effect — and appear in --help, but neither is mentioned in the getting-started guide, and
there is no prose reference page that would cover them.

Affected

• Page: content/docs/getting-started/_index.md (env vars absent)
• Variables: COMPLYTIME_WORKSPACE, COMPLYTIME_EXPORT_ENABLED

Evidence

$ grep -rhoE 'COMPLYTIME_[A-Z_]+' --include='*.go' complyctl | sort -u
COMPLYTIME_EXPORT_ENABLED
COMPLYTIME_WORKSPACE

• COMPLYTIME_WORKSPACE is a way to point the tool at a workspace. It appears only in
  top-level --help: -w, --workspace string workspace directory (env: COMPLYTIME_WORKSPACE …).

• COMPLYTIME_EXPORT_ENABLED has a network side effect. From complyctl scan --help:

  "Export evidence to Beacon collector alongside format report"
  COMPLYTIME_EXPORT_ENABLED=true complyctl scan prod --format sarif

So an environment variable switches on evidence export to an external collector, and the one
page a new user reads never mentions it.

Scope note

Both variables are in --help, which is a legitimate reference surface, so this is not
"undocumented" in the strict sense. The accurate gap is that the getting-started never
mentions them and there is no prose reference page, which makes the network-egress variable
easy to miss. This is kept at this severity primarily because of that network side effect;
treat it as lower if --help is considered sufficient.

Suggested fix

Document both in the getting-started (at minimum a pointer): COMPLYTIME_WORKSPACE
alongside the workspace concept, and COMPLYTIME_EXPORT_ENABLED alongside scan, with a
one-line note: "off by default; sends evidence to a Beacon collector when set to true."
The broader fix is a reference doc page for configuration and environment variables.

---

Related: #68

Issue created with the help of Claude Opus 4.6