feat(scripts): generate self-host env reference

[oktofeesh1]

Summary

• Adds a generated self-host env-var reference sourced from process.env.NAME reads in self-host code.
• Surfaces the generated reference in the self-host configuration website docs.
• Adds CI drift checking plus focused tests for scanner extraction and --check behavior.

What changed

• Added scripts/gen-selfhost-env-reference.mjs with a typed companion declaration.
• Generated apps/gittensory-ui/src/lib/selfhost-env-reference.ts with sorted env names and first source references only.
• Added selfhost:env-reference and selfhost:env-reference:check, with the check wired into test:ci.
• Updated the self-host configuration docs route to include the generated reference.

Why

Operators need a stable self-host env-var reference that cannot drift from source reads or expose example secret values.

Closes #2081

Validation

• npx vitest run test/unit/selfhost-env-reference-script.test.ts
• npm run selfhost:env-reference:check
• npm run typecheck
• npm run ui:typecheck
• npm run ui:lint
• npm run test:ci
• npm audit --audit-level=moderate

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-02 23:22:32 UTC}

6 files · 1 AI reviewer · no blockers · readiness 78/100 · CI green · clean

⏸️ Suggested Action - Manual Review

• Touches a guarded path — held for manual review

Review summary
This adds a deterministic generator for the self-host env reference, commits the generated UI module, wires drift checking into `test:ci`, and renders the reference in the self-host configuration docs. The core extraction path covers static property access, string-literal bracket access, and destructuring, and the generated output avoids values as intended. I do not see a reachable break in the provided files, but there are a couple of documentation/maintainability mismatches worth tightening.

Nits — 6 non-blocking

• nit: `apps/gittensory-ui/src/routes/docs.self-hosting-configuration.tsx:120` says the table is generated from `process.env.NAME` reads in `src/selfhost/**` and `src/server.ts`, but `scripts/gen-selfhost-env-reference.mjs:7` also scans self-host scripts and the output includes script-only names such as `SELFHOST_BUNDLE_ALL`.
• nit: `scripts/gen-selfhost-env-reference.mjs:79` treats any bare identifier named `env` as an env container, so a future local object named `env` with uppercase keys in scanned code would be documented as deployment config even if it is not process/env binding state.
• Update the docs text at `apps/gittensory-ui/src/routes/docs.self-hosting-configuration.tsx:120` to match `DEFAULT_SOURCE_ROOTS`, or narrow `DEFAULT_SOURCE_ROOTS` if scripts should not be part of the public reference.
• Consider making `isEnvContainer` in `scripts/gen-selfhost-env-reference.mjs:79` explicit about the supported containers (`process.env`, `c.env`, or known function parameters) so the generated reference cannot drift from unrelated local variables named `env`.
• Add a small negative test in `test/unit/selfhost-env-reference-script.test.ts` for a non-env local object named `env` if you keep bare-identifier support, because that is the easiest place for false positives to enter this generated operator-facing doc.
• Touches a guarded path — held for manual review — A maintainer must review and merge this change.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#2081
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (size label size:XL; 1 linked issue).
Validation posture	❌ 5/25	Preflight is holding this PR: the review lane is unavailable, so it is not ready for automated review.
Contributor workload	✅ 10/10	Author activity: 76 registered-repo PR(s), 66 merged, 4 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	oktofeesh1; Gittensor profile; 76 PR(s), 4 issue(s).
Gate result	⚠️ Not blocking	Advisory; not blocking this PR.

Review context

• Author: oktofeesh1
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 76 PR(s), 4 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Await review-lane availability.
• Refresh registry data or choose a registered active repo.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.07%. Comparing base (10acd78) to head (f63dbb5).
⚠️ Report is 7 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2596   +/-   ##
=======================================
  Coverage   96.07%   96.07%           
=======================================
  Files         235      235           
  Lines       26353    26353           
  Branches     9559     9559           
=======================================
  Hits        25318    25318           
  Misses        425      425           
  Partials      610      610           

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.