Load shell credentials through Python

[Eli Pinkerton (wallstop)]

DISCLOSURE: LLM-GENERATED TEXT

Why: Interactive shells duplicate the environment parser in Bash.

What:

• Parse shell credentials with the shared typed Python loader through uv.
• Preserve literal values, file selection, and shell variable precedence.
• Apply exports only after parsing succeeds.
• Check loader failures and compatibility cases explicitly.

Refs #171.

---

Note

Medium Risk
Changes how MCP credentials and other env vars are loaded in every interactive shell; mistakes could break agent CLIs or credential rotation without a rebuild, though behavior is heavily contract-tested.

Overview
Replaces inline Bash parsing of .env.local with the shared Python loader invoked via uv run, so interactive shells use the same precedence and literal-value rules as load_environment in Python startup paths (issue #171).

load_env_local in env-local.sh now streams NUL-delimited key/value/overwrite records from env_local.py, skips exports when a non-empty shell value should win (including unexported locals the child cannot see), and applies all exports only after a successful parse—failures return 1 with no partial updates. env_local.py gains loaded_assignments and a small CLI main() that builds the full payload before writing (no shell injection from command substitutions in values).

Tests pin DATAVIZ_ENV_UV, treat loader failures explicitly, and add shell-adapter cases for literals, atomic failure on bad input/missing uv, file path selection, and MCP credential rotation under DATAVIZ_ENV_LOCAL_PRECEDENCE=file.

^{Reviewed by Cursor Bugbot for commit 4c13bc8. Bugbot is set up for automated code reviews on this repo. Configure here.}