Remove test-only env vars from shipped binaries; document PLOYZ_ACME_DIRECTORY #1025

Parent

Spec: first stable tree cleanup and release contracts. Decided in Test-only env vars read by shipped binaries: hide or document.

What to build

Remove every shipped env-var knob that only tests or qualification used. Keep PLOYZ_ACME_DIRECTORY and document it.

Acceptance criteria

• PLOYZ_SSH_CONTROL_PERSIST is gone; ControlPersist=10m is a constant.
• PLOYZ_HEALTH_MONITOR_PERIOD is gone. Tests use the Deploy Intent's per-service update.monitor or wait the 5s default.
• PLOYZ_RELEASE_DIR, ployzd install --release-dir and PLOYZ_UPGRADE_RELEASE_DIR are gone. The stored upgrade receipt has no Local source, and ReleaseSource::Local exists only under #[cfg(test)].
• The setup_cli.rs scenarios run in-process with the bootstrap passed in directly, with no env var.
• core/README.md documents PLOYZ_ACME_DIRECTORY: unset = Let's Encrypt production, a URL = that directory, empty = issuance off.
• grep -rn 'env::var' core/crates/*/src (excluding tests) shows no other PLOYZ_* test knobs.

Blocked by

• Freeze the 1.0 CLI Cluster command tree (its tests set these vars through ployz deploy)