fix(triggers): run.secrets refuses every steering name the pinned sources read (#511)

[edgehero]

Closes #511.

What changes

run.secrets refuses every provider steering name the pinned sources read. The set is still derived from the sources, never hand-typed, and a test compares it both ways.

The scan now:

• reads both copies of pi-ai: the hoisted one and the one the runner loads under pi-coding-agent. Their google-auth-library copies differ: 10.9.1 hoisted, 10.6.2 for the runner.
• follows each SDK's imports one hop further, but only those its package.json declares in dependencies. That reaches google-auth-library, @smithy/core, the AWS credential chain, debug and ws. It does not follow undici, which is only an optional peer of openai.
• counts every occurrence that can reach the environment, instead of matching a list of accessor spellings. Comments are stripped first by a small tokenizer, checked against esbuild's parser on every scanned file. Then it counts every env token (process.env, ctx.env, a parameter named env, { env: e } = process), every process["env"], every use of an alias of one (const v = env(), const e = process.env), and every call of a helper. Helpers are derived, not listed: any named function one of whose own parameters is the key of an environment read (resolveEnvConfigValue(name, env)), so a new call of an existing helper is counted like a read.
• each occurrence either names a variable (a member, a key, a call, an in test, a destructure, or a selector argument, with keys resolved through string constants) or is a site. Every file's sites are pinned with a count in worker/test/fixtures/provider-steering-sites.json. So a new occurrence anywhere either names something the equality sees or changes a count, and the failure prints the entries to review. The names pi reads outside its PI_* namespace are pinned too. Forms with no env token at all (Reflect.get(process, "env"), process["e" + "nv"]) are a stated limit; none occurs at the pin.
• adds pi's own PI_* reads from pi-coding-agent's dist/ (not dist/bundle/) and from the pi packages it declares. It subtracts the names the worker writes and the ones the runner assigns before pi runs (PI_OFFLINE, PI_TELEMETRY).

Matching stays exact, so google_application_credentials is refused while openai_base_url stays bindable. The set grows from 68 to 132 names: 64 added, none removed. The hand-written residuals drop from nine to four.

A job queued before the set widened, a stored cron schedule, or an older receiver can still carry such a name. The worker now checks the same reserved set against the job at the call site, before the secrets resolver is called, and refuses it before anything spends as secret-name-reserved, naming the key.

Operator impact (release notes must say this)

A triggers file that binds any newly reserved name stops loading, and a queued job that binds one is refused. Some of these are ordinary names, such as DEBUG, HOSTNAME, K_CONFIGURATION, AWS_EXECUTION_ENV and PI_TUI_DEBUG. Put those on PI_FORWARD_ENV instead.

Tests

• provider-steering.test.mjs goes from 9 to 16 tests, including a fixture test of every access form. triggers.test.mjs gains a refusal test and a still-bindable test. processor.test.mjs gains a test for the pre-spend re-check, with a resolver that fails if it is ever reached.
• 34 mutations, each shown red then reverted. On the rule: uppercase-only capture, no hop 2, hoisted copy only, no dot form, no constant resolution, no config.js evaluation, no assignment check, no runner subtraction, scanning dist/bundle/, no alias receivers, counting only process.env, no selector form, no destructure form, no comment stripping, no env() result follow, no process["env"] count, no helper derivation, case-insensitive matching, a deleted name, and no pre-spend re-check. Added to the pinned sources: const { X } = process.env, an alias, process.env?.X, ctx.env("X"), env[CONST], a template key and a runtime key in openai/client.mjs, a new process.env[name] helper in pi-ai, const v = env(); v.X in @google/genai, process["env"]["X"], import { env as E } from "node:process", and two new calls of the existing resolveEnvConfigValue helper.
• By hand: with google_application_credentials, and again with PI_CODING_AGENT_DIR, in run.secrets:
  • pi-dispatch doctor prints ✗ triggers file is refused at load;
  • pi-dispatch worker exits 2 with the same "is reserved" error.