feat(harbor): load .env for StirrupAgent credentials

[ShuxinLin]

Description

StirrupAgent now loads the nearest .env above the working directory before it checks router credentials. uv run harbor run ... --model tokenrouter/MiniMax-M3 then works from the repo root without exporting TOKENROUTER_BASE_URL / TOKENROUTER_API_KEY.

• Precedence: --ae KEY=VALUE, then exported shell variables, then .env. The file is loaded with override=False, so it never replaces a variable that is already set.
• Scope: the file is read host-side, in the Harbor process. Only the names in CREDENTIAL_ENV_VARS are forwarded into the agent container, and .dockerignore still keeps .env out of every image.
• Verifier: Harbor resolves [verifier].env templates at verify time (harbor/verifier/verifier.py), after the agent is constructed, so AOB_JUDGE_MODEL and the judge keys are also picked up from .env.
• Limitation: --agent oracle never constructs StirrupAgent, so it does not load .env. Use --env-file .env there if a scenario needs a judge. This is documented in the README.

Stacked on #558. It targets feature/harbor-integration because src/assetops_harbor/ is not on main yet.

Type of Change

• New Benchmark Scenario (Industry/Asset type)
• Evaluation Metric / Scorer
• Agentic Orchestration Logic (ReAct, Plan-Execute, etc.)
• Infrastructure / Tooling Improvement

Industry Relevance

None directly. This only affects how credentials reach Harbor runs.

Related Issues

• Refs: feat(harbor): run AssetOpsBench scenarios as Harbor tasks #558

Testing & Validation

• Unit Tests: uv run pytest src/assetops_harbor passes (19 passed, 2 new):
  • test_router_credentials_from_dotenv_satisfy_the_check
  • test_exported_variables_win_over_dotenv
• Scenario Validation: not run against a live Harbor job.
• Data Integrity: no data files touched.

The test changes:

• An autouse fixture chdirs into tmp_path, so a developer's own .env cannot leak into the adapter tests.
• no_router_credentials now does setenv then delenv, so teardown also removes variables that load_dotenv writes during a test.

The full suite (uv run pytest src/ -k "not integration") has 19 failures, all outside this change. The same 19 fail with --ignore=src/assetops_harbor: servers/iot/tests/test_tools.py (11), evaluation/tests/test_static_json_scorer.py (6), observability/tests/test_file_exporter.py (2).

Checklist

• My code follows the project's Ruff formatting and linting rules.
• I have performed a self-review of my code.
• I have updated the documentation (README or /docs) accordingly.
• I have signed off my commits (DCO).