run.secrets can still bind a few steering names: lowercase Google twins, the billing project, and pi's own agent directory #511

Why this is needed

run.secrets refuses the provider steering variables pi and its provider SDKs read, derived from their sources (worker/src/provider-steering.mjs, re-derived for pi 0.99.1 in #509). A scan of about 180 environment names read across the 0.99.1 SDKs found a few that steer a request or a credential and are still bindable. All of them were equally bindable before #509:

• Lowercase twins of reserved Google names. google_application_credentials is read by google-auth-library (build/src/auth/googleauth.js:316) and was measured planting a credential file the job then uses. gcloud_project and google_cloud_project are the same kind of twin for the project variables. The derivation compares names exactly, so the uppercase forms are refused and the lowercase ones are not.
• GOOGLE_CLOUD_QUOTA_PROJECT chooses which project is billed (googleauth.js:286).
• PI_CODING_AGENT_DIR: pi's own environment reads are outside the derivation entirely, so a trigger can point the job's pi at another agent directory.

Who is affected: an operator whose triggers file is edited by someone they trust less than the deployment (the file is reviewed, so this is defence in depth, not an open door).

What to build

1. Make the derivation case insensitive where the reading code is (google-auth reads both spellings), or add each lowercase twin the scan finds, pinned by the scan so a new twin fails the test.
2. Add GOOGLE_CLOUD_QUOTA_PROJECT to the reserved set through the scan, not by hand.
3. Extend the scan to pi-coding-agent's and pi-ai's own process.env reads, subtracting the variables the runner sets itself, and reserve the ones that change where pi reads its configuration or credentials (PI_CODING_AGENT_DIR and any siblings).

What not to do

• Do not hand-type the new names: the list must stay derived from the sources, or it drifts at the next pi bump.
• Do not refuse names no pinned source reads.

How to test it

• worker/test/provider-steering.test.mjs: the scan finds each name above against the pinned 0.99.1 sources, and a triggers file binding any of them is refused at load; a mutation that drops the lowercase handling turns it red.
• By hand: a triggers file with run.secrets naming google_application_credentials is refused by pi-dispatch doctor and by the worker at boot.

Acceptance

• Every name above is refused in run.secrets, by derivation.
• The scan covers pi's own environment reads.

Depends on

#509 (the 0.99.1 sources the scan reads).