varlock: commit the active schema and replace stale Keychain guidance

[WalksWithASwagger]

Context

SpektorAI has a local schema, but it is currently excluded by a broad .env* ignore rule and its documented Keychain workflow no longer matches the shared Varlock model. The contract also covers only a subset of active runtime consumers. Adopt WalksWithASwagger/kk-agents#23 and make the committed contract truthful.

Acceptance Criteria

• Adjust ignore rules narrowly so .env.schema is tracked while value-bearing .env* files remain ignored.
• Reconcile the schema against active committed code references, excluding virtual environments, generated files, fixtures, and archived code.
• Add declarations only for confirmed active consumers; do not invent credentials.
• Import approved reusable values through the shared convention with allowMissing=true.
• Replace stale Keychain-specific agent guidance with the shared Varlock contract.
• Add focused tests for tracked-schema presence, redacted load/run, and names-only audit exclusions.

Tests/Evals

• git ls-files .env.schema returns the committed schema.
• Active code references are either declared, explicitly non-secret/config-only, or documented as intentionally external.
• Existing agentic tests remain green.

Verification

python3 -m pytest tests/agentic -q
git check-ignore -v .env.schema || true
git diff --check

Also run redacted varlock load --agent --show-all, varlock scan, and a no-op varlock run --inject vars -- ....

Agent Instructions

• Work from a clean worktree based on origin/main; do not use the current feature checkout.
• Follow WalksWithASwagger/kk-agents#23.
• Inspect committed code and names only. Never open a value file or process environment.
• Keep the schema limited to current runtime consumers.

Out of Scope

• Real credential migration.
• Cloud or production changes.
• Declaring variables found only in virtual environments, generated output, or archives.
• Adding another secret manager.

[github-actions]

Agentic issue quality gate failed: Stop labels present: in-progress

[github-actions]

Agentic dev loop started on branch codex/issue-65-varlock-commit-the-active-schema-and-replace-sta with provider noop.