fix(posture): honor effective env layers

[gfargo]

Summary

Advance #248 by making posture's required_vars check evaluate each stack's effective default environment instead of grepping only the project-level .env file.

Changes

• resolve stack-level .env before the project-level fallback
• reconstruct common, base, topology host, and generated stack/host layers in deployment precedence
• isolate each stack's env and topology state in a command-substitution boundary
• reserve evaluator stdout for missing variable names and keep loader diagnostics on stderr
• validate required names before env lookup using deployment's shell-identifier grammar
• preserve existing posture findings, no-env warning text, counters, JSON shape, and exit thresholds
• leave repository-wide placeholder/git hygiene checks and named --env semantics unchanged

Validation

• bats tests/test_posture.bats tests/test_validate.bats tests/test_utils.bats tests/test_env_gen_layer.bats tests/test_topology.bats tests/test_cli_resolve.bats </dev/null — 215 passed
• bats tests/ </dev/null — 2,650 passed, 2 expected skips
• direct fixtures for stack/common/host layering, cross-stack isolation, stderr-only diagnostics, and malformed names with and without an env file
• shellcheck -x -S warning lib/cmd_posture.sh
• bash -n lib/cmd_posture.sh
• git diff --check
• semantic review approved with no actionable findings

Advances #248.