Reconcile portable env/enc config with Zed package env contracts #105

Context

Canonical architecture: https://github.com/ORESoftware/ores-docs/issues/3
Landed architecture: https://github.com/ORESoftware/ores-docs/pull/4
Shared GHA bootstrap: https://github.com/ORESoftware/.github/issues/227
ores-sops composition: ORESoftware/ores-sops#40
Fleet audit: https://github.com/ORESoftware/ores-cli/issues/344
Typed config contract: ORESoftware/typespec-json-schema-validator#177

Zed already has package-level environment dependency semantics in .zpkg.toml; portable encrypted configuration must compose with that model rather than creating a second declaration authority.

Authority model

• .zpkg.toml [env] describes package/runtime environment dependencies, metadata, and transitive dependency intent.
• .cli-flags.toml remains argv -> environment normalization authority where applicable.
• env/enc carries encrypted environment/profile values.
• ores-sops owns secure composition/decryption.
• ores-cli audits cross-repository adoption/drift.
• TypeSpec + independently authored JSON Schema describe portable config scope/classification where needed, with TJSV convergence evidence.

A value being encrypted does not replace its package-level declaration or type metadata.

Required work

• map .zpkg.toml env declarations to portable config key metadata without duplication or contradictory types;
• define how required/optional/secret/type metadata converges between Zed package env contracts and portable env contracts;
• detect transitive dependency key collisions before decryption/execution;
• keep dev|stage|prod separate from local|gha|gha-indie-worker|test;
• preserve package-manager portability: local, GHA, and Indie Worker should resolve the same declared key set for the same package graph and env/profile;
• use encrypted Git config for concrete values that should travel with repository execution;
• retain bootstrap identities outside the ciphertext they unlock;
• ensure secret values never enter Zed manifests, locks, package receipts, audit output, or registry metadata;
• add fixtures for direct and transitive env dependencies, compatible duplicates, incompatible duplicates, profile overrides, missing required config, and secret redaction;
• integrate with ores-cli#297 package env-contract enforcement rather than building a parallel scanner;
• document when an env dependency belongs to a package vs a deploy-only surface.

Acceptance

1. Zed package env metadata and portable encrypted values compose without competing authorities.
2. Package dependency resolution can determine required key names/types without decrypting values.
3. Local/GHA/worker execution consumes the same package-derived config contract.
4. Transitive conflicts fail closed before runtime.
5. Secret values remain absent from package/public evidence surfaces.