Final-verification findings: unquoted PI_BACKEND_FLOOR refused by doctor, cancel wording, foreground worker vs doctor's .env #477

Three defects found by the round-446 final verification on pd-fedora (main f0db57e):

1. doctor refuses the documented unquoted PI_BACKEND_FLOOR. PI_BACKEND_FLOOR=isolation=enforced in .env is the form docs/podman.md and .env.example show. Doctor gives a false ✗ ("in a form ... (quotes, a $, a space)"), then says "✓ PI_BACKEND_FLOOR is not set" and never judges the floor. UNQUOTED_PLAIN (worker/src/env-file.mjs ~1439) rejects an = inside a value, though no loader treats an interior = specially. Since doctor judges many service keys from its shell while the service reads them from .env #471, every service key doctor resolves goes through that reader. The service itself reads the value correctly.
2. cancel says a job "never ran" when it did. On a job waiting to retry after a failed attempt, which has a run record and a retained sandbox, it prints "removed ... (delayed): it never ran; no record written" (worker/src/cancel-cli.mjs ~115).
3. A worker started by hand takes VALKEY_URL only from its shell, while doctor judges .env. In the deployment folder, doctor judged .env's Valkey (port 16592) and ended with "Start the worker with pi-dispatch worker". That worker, started by hand, dialled 127.0.0.1:6379. run, status and cancel read .env since fix(worker): the Valkey pi-dispatch starts gets a per-deployment password (#468) #475, so the foreground worker, or the advice doctor gives, must agree with what doctor judged.

To do: fix all three and pin each. For (3), decide between two options and say why:

• the foreground worker reads the deployment .env through the same resolver, with the shell winning where set;
• doctor's advice names how to start a worker that sees .env.