docs(env-vars): correct the no-match-recheck timeout description (review HIGH 3 follow-through)

Same false framing as the code comment and job README already fixed: FLOWSHEET_NO_MATCH_RECHECK_LML_PER_CALL_TIMEOUT_MS is a client-side socket-abort safety net, not a lever that gives LML "its full cascade on retry" -- the class-5 X-Caller-Budget-Ms header's presence, not this value, is what arms LML's empty-state cutoff. Missed this file in the earlier pass since the same claim lives in three places (lml-fetch.ts, the job README, and here).

Author: jakebromberg

docs/env-vars.md

@@ -236,7 +236,7 @@ Recurring cron generalizing the one-shot `enriched_no_match` rescue drains into
 
 - `FLOWSHEET_NO_MATCH_RECHECK_TTL_DAYS` (default `14`) — Rows stamped `no_match_recheck_attempted_at` (a genuine no-match or a trust-gate rejection) are skipped until this window expires. Shorter than `rotation-release-id-backfill`'s 30-day default because the cohort here is orders of magnitude larger and includes rows whose upstream cause (a discogs-etl rebuild, an LML matcher fix) resolves on a shorter cadence than rotation's curated, MD-reviewed cohort.
 - `FLOWSHEET_NO_MATCH_RECHECK_BATCH_SIZE` (default `200`) — Candidate query `LIMIT`. The bounded-drip ceiling: caps LML call volume per run independent of how large the total `enriched_no_match` cohort is. Candidates are ordered oldest-recheck-attempted-first (`NULLS FIRST`), so a cohort larger than one batch drains fairly across runs instead of starving any one slice.
-- `FLOWSHEET_NO_MATCH_RECHECK_LML_PER_CALL_TIMEOUT_MS` (default `35000`) — Per-call abort budget. Deliberately mirrors `flowsheet-metadata-backfill`'s generous default (not `rotation-release-id-backfill`'s stricter `8000`) — this job's whole premise is giving a cold, previously-unresolvable release LML's full cascade on retry.
+- `FLOWSHEET_NO_MATCH_RECHECK_LML_PER_CALL_TIMEOUT_MS` (default `35000`) — Client-side socket-abort safety net, not a lever that extends how long LML itself searches (BS#2179 review HIGH 3 correction). Deliberately mirrors `flowsheet-metadata-backfill`'s `BACKFILL_LML_PER_CALL_TIMEOUT_MS` default (not `rotation-release-id-backfill`'s stricter `8000`). This caller sends the class-5 `X-Caller-Budget-Ms` header unconditionally, and the header's mere presence — not this value's magnitude — arms LML's own ~4s empty-state cutoff; see `shared/lml-client/src/policy.ts`'s "CORRECTED MODEL". A cold, hard-to-resolve release is expected to come back `degraded_reason: 'deadline_exceeded'` well under this timeout, which `lml-fetch.ts`'s `isUnansweredDegraded` treats as transient so the row stays retryable — this constant only bounds a genuinely wedged connection.
 - `DRY_RUN` (default unset / `false`) — same locked-value parsing as the other jobs (case-insensitive `true`/`1`, trimmed): skips every write, including marker-only attempts, and increments `resolved_dry` instead of `resolved` for trusted matches.
 
 ### Library discogs_unavailable recheck (`jobs/library-discogs-unavailable-recheck`)