feat: parse runtime config with flags-2-env

[ORESoftware]

Summary

• pin the canonical flags-2-env Rust binding at d7bad9ea7dfc657653368237e08903514cdca1ec
• resolve audited non-secret runtime configuration before tracing, network, or database effects
• fail closed on unknown options while keeping database and session credentials environment-only
• correct the pre-existing invalid Zed manifest package name

Validation

• flags2env audit .cli-flags.toml: 0 errors, 0 warnings
• cargo test --all-targets --locked: 94 passed
• cargo clippy --all-targets --all-features --locked -- -D warnings
• cargo fmt --all -- --check
• real binary help, version, and redacted unknown-option rejection

External blocker

zed install cannot resolve zed-pkg/zed-interfaces because https://registry.zpkg.net/v1/packages/zed-pkg/zed-interfaces timed out with no response. This PR remains draft until a canonical .zpkg.lock can be generated and verified.

[ORESoftware]

2026-09-10 consistency review: do not merge this stale head as-is. Its useful invariant—resolve an audited immutable flags snapshot before server effects—still matters, but the branch is now non-mergeable and its .cli-flags.toml predates the current flags-2-env schema ([identity], per-flag long, and type = "boolean"). Current canonical consumers use aliases, type = "bool", strict unknown-key rejection, and the actual owning native parser as the admission authority (see the current zed-api-server #63 consolidation). Salvage the runtime/config logic onto current main, preserve secret env-only boundaries, translate only the contract vocabulary, add an exact Cargo-pinned native flags2env audit, and regenerate/verify the lock through the real resolver rather than merging this historical branch wholesale.

[ORESoftware]

DEN-390 salvage update: current main has already absorbed the independent package-identity and task-ownership pieces from this stale branch via #56/#57. I have preserved this PR as runtime-integration provenance and opened #59 from current main for the portable .cli-flags.toml authority + exact-parser admission gate only. #59 canonicalizes aliases/bool, explicitly disables ambient dotenv with [env] files = [], keeps secret-bearing envs out of public flags, and audits against both this PR's exact production parser d7bad9ea7dfc657653368237e08903514cdca1ec and a reviewed forward parser. The Cargo/Cargo.lock/runtime portion here is intentionally not replayed wholesale; after #59 lands it can be salvaged separately with a fresh resolver-owned lock and current-main semantics. No rebase/reset/stash/force update or branch closure.

[ORESoftware]

Follow-up: the current-main source-contract salvage landed via #59 as merge 8f8cda7db55fb4f783c50a756d05cb4e5bb5bb29 after exact-head normal CI, production+forward flags2env audits, source/agents policy, and formal browser mutation safety all passed. This PR remains preserved as runtime-integration provenance only. Its remaining useful runtime behavior should be lifted onto the merged contract with current dependencies and a freshly resolver-owned Cargo.lock; do not merge this stale/conflicted branch wholesale.