DEN-390: execute web startup through bundled flags2env

[ORESoftware]

Summary

Close the executable-contract gap tracked in #61: .cli-flags.toml was already admitted in CI, but server.rs still read public runtime settings directly from std::env.

This draft routes startup through one bundled flags2env boundary before tracing, database, auth, network, or listener effects:

• pin flags2env to immutable runtime revision d7bad9ea7dfc657653368237e08903514cdca1ec;
• audit and parse .cli-flags.toml through BundledFlags2Env;
• fail closed on parser errors, unknown options, positionals, or unexpected commands;
• preserve precedence defaults < declared dotenv < process environment < dotenv overrides < argv;
• coerce the public runtime surface into typed Rust values before server composition;
• sample credential-bearing values once from process env while excluding them from public flags/coercion input;
• remove scattered std::env::var reads from server.rs;
• make --help / --version explicit startup intents rather than accidentally booting the listener;
• retain dual no-ambient-dotenv isolation (dotenv = false, files = []).

Regression coverage

The new startup module tests:

• source precedence through the structured flags2env channels;
• secret process values never enter the public coercion map;
• help/version mutual exclusion;
• dual dotenv isolation and secret ignore ownership.

server.rs additionally asserts that it contains no direct process-env reads or legacy dotenv loader and that the binary remains a thin Tokio adapter.

Lock provenance

Cargo.lock is not hand-edited or copied from stale #43. A temporary branch-specific workflow runs Cargo against the existing lock, requires the lock to be the only generated change, then executes fmt, locked check/tests, and strict Clippy before committing the Cargo-produced lock candidate. The workflow must be removed before promotion.

Merge gate

Keep draft until:

1. the hosted lock generator produces and commits the real lock;
2. the one-shot write-enabled workflow is removed;
3. exact-head normal repository CI/contract/source-policy/formal/container gates execute stepfully and are green;
4. hostile-dotenv, unknown-option, typed-invalid-value, argv-over-env, and secret-env behavior are exercised by the built executable or equivalent native tests;
5. no credential values are reflected in failure output.

No deployment, database mutation, credential change, or branch-protection change is included.

Tracking: DEN-390; closes implementation scope of #61 when merged.

[linear-code]

DEN-390