varlock: adopt shared local value imports

[WalksWithASwagger]

Closes #65

Summary

• selectively import seven confirmed reusable credentials from the canonical shared and SpektorAI override files with pick and allowMissing=true
• keep the local schema authoritative, mark Varlock 1.10 audit-only false positives explicitly, and document CI, container, and Make-owned external names
• replace Keychain-specific agent assumptions with the shared Varlock contract and unchanged app-runtime policy
• add focused tracked-schema, runtime-name, audit-exclusion, redaction, and no-op injection tests using only an isolated HOME and sanitized fixtures

Verification

• python3 -m pytest tests/agentic/test_varlock_contract.py -q (6 passed, 22 subtests passed)
• python3 -m pytest tests/agentic -q (22 passed, 22 subtests passed)
• python3 scripts/docs_truth_check.py (docs-truth-check: OK)
• git ls-files .env.schema returns .env.schema
• .env.schema is not ignored; .env.local, .env.shared.local, and .env.spektorai.local remain ignored
• git diff --check and git diff --cached --check
• isolated standalone Varlock 1.10 load --agent --show-all
• isolated standalone Varlock 1.10 no-op run --inject vars -- /usr/bin/true
• isolated standalone Varlock 1.10 scan and scan --staged

Varlock 1.10's names-only audit still emits the existing eight false "unused" warnings for os.environ.get, helper-indirect, and workflow-fed references. Each name is now explicitly decorated with @auditIgnore, and the focused tracked-source test confirms every active name is declared while excluding venv, generated, archive, and fixture noise.

Docs Impact

• Commands, paths, and env vars in docs still match the code
• Status, roadmap, and tracker claims were left untouched
• make docs-check equivalent passed via python3 scripts/docs_truth_check.py

Acceptance Self-Check

• Adjust ignore rules narrowly so .env.schema is tracked while value-bearing .env* files remain ignored.
• Reconcile the schema against active committed code references, excluding virtual environments, generated files, fixtures, and archived code.
• Add declarations only for confirmed active consumers; do not invent credentials.
• Import approved reusable values through the shared convention with allowMissing=true.
• Replace stale Keychain-specific agent guidance with the shared Varlock contract.
• Add focused tests for tracked-schema presence, redacted load/run, and names-only audit exclusions.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[github-actions]

Agentic PR Review

Verdict: needs-human

Checks:

• Linked issue via Closes #...: yes
• Issue acceptance criteria found: 6
• PR verification section present: yes
• PR acceptance self-check present: yes
• PR self-check covers issue acceptance: no
• Diff within v1 limits: yes
• Missing acceptance coverage:
  • Adjust ignore rules narrowly so .env.schema is tracked while value-bearing .env* files remain ignored.
  • Reconcile the schema against active committed code references, excluding virtual environments, generated files, fixtures, and archived code.
  • Add declarations only for confirmed active consumers; do not invent credentials.
  • Import approved reusable values through the shared convention with allowMissing=true.
  • Replace stale Keychain-specific agent guidance with the shared Varlock contract.
  • Add focused tests for tracked-schema presence, redacted load/run, and names-only audit exclusions.

This PR is not blocked from human review, but the agentic gate is not satisfied.

[github-actions]

Agentic PR Review

Verdict: needs-human

Checks:

• Linked issue via Closes #...: yes
• Issue acceptance criteria found: 6
• PR verification section present: yes
• PR acceptance self-check present: yes
• PR self-check covers issue acceptance: no
• Diff within v1 limits: yes
• Missing acceptance coverage:
  • Adjust ignore rules narrowly so .env.schema is tracked while value-bearing .env* files remain ignored.
  • Reconcile the schema against active committed code references, excluding virtual environments, generated files, fixtures, and archived code.
  • Add declarations only for confirmed active consumers; do not invent credentials.
  • Import approved reusable values through the shared convention with allowMissing=true.
  • Replace stale Keychain-specific agent guidance with the shared Varlock contract.
  • Add focused tests for tracked-schema presence, redacted load/run, and names-only audit exclusions.

This PR is not blocked from human review, but the agentic gate is not satisfied.

[github-actions]

Agentic PR Review

Verdict: review-ready

Checks:

• Linked issue via Closes #...: yes
• Issue acceptance criteria found: 6
• PR verification section present: yes
• PR acceptance self-check present: yes
• PR self-check covers issue acceptance: yes
• Diff within v1 limits: yes

[github-actions]

Agentic PR Review

Verdict: review-ready

Checks:

• Linked issue via Closes #...: yes
• Issue acceptance criteria found: 6
• PR verification section present: yes
• PR acceptance self-check present: yes
• PR self-check covers issue acceptance: yes
• Diff within v1 limits: yes