fix: define host runtime environment ownership

[webup]

What changed

• narrowed the runtime environment work to host roles (dev, serve, worker, and scheduler), leaving container/Compose policy for the separate Train B design;
• made inherited keys authoritative by presence, including explicit empty values, with strict independent dotenv parsing;
• removed runtime-settings import side effects from non-runtime CLI commands;
• launched worker and scheduler through fresh child processes so settings initialize after environment resolution;
• added bounded POSIX/Darwin/Windows foreground-child ownership and signal cleanup;
• added exact minimum-direct-dependency and cross-platform compatibility proofs;
• documented the host environment contract and upgrade notes.

Why

PR #69 exposed a design-level problem: source parsing, assignment precedence, runtime initialization, and container handoff were being changed together. That made fixes in one boundary create regressions in another. This replacement keeps the API release focused on one host-runtime ownership contract and defers the separately reviewed container boundary.

User and developer impact

• shell/inherited values consistently win, including KEY=;
• each dotenv file uses file-local interpolation and malformed files fail before child startup;
• worker and scheduler observe resolved settings in fresh processes;
• interrupts and termination clean up owned child process trees without leaking values in diagnostics;
• version, help, and Dockerfile rendering no longer instantiate runtime settings.

Validation

• repository coverage: 994 passed, 6 skipped, 90.37% with the existing 90% threshold;
• three-OS compatibility selection: 283 passed, 1 skipped locally where applicable;
• minimum-direct-dependency contract: 55 passed on Python 3.12 with python-dotenv==1.0.0;
• focused host-runtime suite: 147 passed, 1 skipped;
• Ruff lint, changed-file formatting, YAML parsing, diff checks, and deferred-container symbol scan passed;
• independent exact-head review: 0 critical, 0 important, 0 minor findings.

The local Docker smoke could not pull uncached Docker Hub images because the OrbStack daemon route timed out. This draft exists so hosted CI can provide the Docker-runtime and native Windows evidence before any merge or release decision.

This is a replacement implementation direction for #69; the contributor PR is intentionally left untouched.