Inject an Env seam into the manifest env() Jinja function

[leynos]

Context

The manifest env() Jinja function reads the process environment directly at src/manifest/mod.rs:85:

fn env_var(name: &str) -> std::result::Result<String, Error> {
    match std::env::var(name) {

The function has three distinct outcomes — present, NotPresent, and NotUnicode — and the last two are precisely the cases that are awkward to reach without mutating the real environment. Under the AGENTS.md testing mandate, in-process mutation is no longer available, so these branches currently have no legitimate route to coverage.

The doc comment on env_var already advertises a test_support::env::VarGuard that mutates global state; that example must go with the implementation.

Required work

• Give env_var an injected environment, and carry it on the value registered into the Jinja environment so manifest::from_str can supply one.
• Supply the process-backed default reader (process_env_reader) at the manifest public boundary.
• Rewrite the env_var doc example to construct a MockEnv rather than a mutating guard.
• Migrate tests/manifest_env_tests.rs onto the injected seam, covering all three outcomes including the non-UTF-8 branch.

Acceptance criteria

• No std::env::var call remains in src/manifest/mod.rs.
• tests/manifest_env_tests.rs no longer acquires EnvLock or mutates the process environment.
• The NotUnicode branch is covered by a test.
• make check-fmt, make lint, and make test pass.

---

Amended: the seam is a closure (EnvReader), not &impl mockable::Env.
The requirement above has been rewritten to match; see the discussion below for
the reasoning. mockable is a dev-dependency, and the proportionality argument
is that a production dependency is a large price for reading one variable when
the repository already uses closure seams of the same shape in stdlib::path,
output_mode, output_prefs, and theme.

[coderabbitai]

🔗 Related PRs

leynos/vk#163 - Add regression tests for coderabbit comment spacing [closed]
#497 - Stop the mock environment mutating the real process environment (#490) [open]
#498 - Give the workspace fallback switch an injectable env seam (#487) [open]
#501 - Give the manifest env() helper an injectable env seam (#484) [open]
#502 - Make the locale test stub strict about unexpected variable reads (#489) [open]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[leynos]

Tracked under #496.

[leynos]

Acceptance criterion corrected

The issue implied mockable::Env for the manifest seam. That is withdrawn.

mockable is a dev-dependency reaching the crate only through test_support. manifest is production code, so using mockable::Env there requires moving mockable into [dependencies], which pulls mockall into release builds of a build tool. That is not a reasonable price for replacing a two-line closure alias, and the same question was resolved the same way on #489.

AGENTS.md permits the alternative explicitly: a narrow closure seam of the same shape, where a trait object would be disproportionate. EnvReader is Fn(&str) -> Result<String, VarError> — mockable::Env::raw's shape exactly.

Revised criterion: the Jinja registration path is exercised without process mutation. PR #501 meets it: from_str_with_env drives the real Environment and the real add_function("env", ..) call, and tests/manifest_env_tests.rs covers present, empty, missing, and non-UTF-8 values with no VarGuard and no #[serial].