refactor(cli): cover viper-env with effect lint (CLI-2650)

[7ttp]

TL;DR

brings viper-env and the experimental gate tests under the effect lint

whats introduced?

• viper-env and experimental-gate join the allow list
• the SUPABASE_* readers read through Config and become effects, so every caller keeps its flag || env short-circuit and the same true, false, empty and unset handling
• dumpNetworkMode in pg-dump.run becomes an effect for the same reason
• tests that set these vars through process.env would pass without testing anything once Config snapshots the env, so they pin them through withConfigEnv, and the unset guards also hide them from Config through a new withEmptyConfigEnv helper
• the shadow cache guard becomes a shadowCacheDisabledLayer merged into each file's setup

ref

• closes: CLI-2650

[github-actions]

🤖 AI Review

Verified both independent reviews against the PR code and trusted conventions. Confirmed one non-blocking failure-policy nit and refuted the claimed db-pull test-isolation regression. No confirmed user-facing correctness issue. Verification was static because dependencies are not installed.

Findings

Severity	Location	Category	Sources	Claim
⚪ NIT	apps/cli/src/command-internal/viper-env.ts:18	error-handling	claude	The new Config-based environment readers convert provider failures into untyped defects without documenting that failure policy.

Refuted findings (kept for transparency, not posted as review comments)

• apps/cli/src/commands/db/pull/pull.integration.test.ts:1679 (test-isolation): Replacing the shell-variable unset with only withEmptyConfigEnv leaves the project .env network tests dependent on the ambient SUPABASE_NETWORK_ID.
  Refuted: The asserted seed dump uses the projectEnv map loaded by runDbPull at db-pull-run.ts:171 and passed to network resolution at lines 500-503 and the dump at line 539. loadProjectEnv checks ambient values through configEnvOption, not process.env, at db-config.toml-read.ts:837-841; withEmptyConfigEnv therefore isolates this map and the subsequent Viper read. Although local-container setup separately loads a context using process.env, that context does not supply this seed dump's projectEnvValues. Squash uses localInputs.context.projectEnvValues for its dumps, explaining its paired guards.

Stats

Claude findings: 1 · Codex findings: 1 · Confirmed: 1 · Refuted: 1 · Uncertain: 0

---

Models: claude-opus-5-5 + gpt-6.1-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.