Say when a provider API key is empty, not just unset #144

Context

On exactml/marginal-client the ANTHROPIC_API_KEY secret was saved with an empty value. The review failed with:

marginal review: the 'anthropic' provider requires the ANTHROPIC_API_KEY environment variable to be set

The variable was set. marginal-action always exports it, empty when the secret is missing or blank. So the message points away from the real cause. In GitHub Actions, a missing secret and an empty one look the same here.

Behavior to implement

When the variable exists but is empty, the error says so and names what to check: the repository secret exists and has a value (and forked PRs never get secrets). An unset variable keeps today's message. marginal doctor builds providers the same way, so it gets the clearer message too.

Acceptance criteria

• ANTHROPIC_API_KEY="" gives the empty-value message; unset gives the existing one. Both still exit 3.