Control manifest environment access

The Jinja env() helper can read process environment variables while rendering a manifest. Configure exact variable names with env_allow_var and env_block_var as arrays in a Netsuke configuration layer:

env_allow_var = ["CI", "PACKAGE_REGISTRY_TOKEN"]
env_block_var = ["AWS_SECRET_ACCESS_KEY", "GITHUB_TOKEN"]

The environment equivalents contain serialized JSON arrays, rather than bare variable names:

NETSUKE_ENV_ALLOW_VAR='["CI","PACKAGE_REGISTRY_TOKEN"]'
NETSUKE_ENV_BLOCK_VAR='["AWS_SECRET_ACCESS_KEY","GITHUB_TOKEN"]'

CLI flags take one exact name and may be repeated:

netsuke --env-allow-var CI --env-allow-var PACKAGE_REGISTRY_TOKEN \
    --env-block-var AWS_SECRET_ACCESS_KEY --env-block-var GITHUB_TOKEN

With neither effective list configured, env() remains default-allow for compatibility. Adding at least one effective env_allow_var entry makes the allowlist restrictive: only listed names may resolve. An env_block_var list without an allowlist blocks only its listed names. A blocklist entry always overrides an allowlist entry. Every entry is one exact variable name; this policy has no glob or pattern matching. env_allow_var entries from project occurrences selected through .netsuke.toml and its extends chain are removed before policy composition. This prevents a checkout-controlled ancestor from widening the operator allowlist or activating default-deny. env_block_var entries remain cumulative because they only restrict access. Operator chains and unrelated explicit configuration chains retain their grants; a file reached from both project and operator roots keeps its separate authority for each occurrence.

This policy reduces secret ingress into rendered manifest fields. It does not make rendered manifest contents safe to log: allowed values still require the existing output and logging discipline.

Exact and wildcard host matching ignores one terminal DNS dot: example.com matches example.com., and *.example.com matches sub.example.com.. The wildcard does not match the apex, so *.example.com does not match example.com..

Avoid placing secrets in URLs. Netsuke logs hosts and cache keys rather than complete URLs, but downloaded content and commands still run within the host trust boundary.