Define product-owned action-scoped environment inventories

[jeremi]

Outcome

Governed one-shot actions receive only the environment keys they need, using product-owned versioned inventories rather than lane-wide environment files or Registryctl-maintained copies of product configuration schemas.

This is post-1.0 hardening. The 1.0 contract remains intentionally small: preview and exact verify receive no environment or secrets; accept receives the signed lane environment only for the existing product-owned audit configuration, with no serving file secrets or network access.

Design constraints

• Product crates own the meaning and validation of their environment keys.
• Registryctl and the release lock must not duplicate dynamic product schemas.
• The contract remains closed and versioned. It is not an arbitrary environment-projection language.
• Source, OAuth, ingestion, serving, signing, and cross-lane credentials remain unavailable to state-only actions.
• Secret values stay in operator-owned material and never enter generated configuration or diagnostics.

Definition of Done

• Relay and Notary publish machine-readable, versioned action-to-environment inventories from product-owned definitions.
• The signed release contract binds the exact inventories used by generated deployments.
• Generated one-shot services project only the declared keys for their action.
• Missing, extra, cross-lane, source, OAuth, ingestion, and serving capabilities fail closed in tests.
• Audit-before-mutation and existing product semantic validation remain intact.
• Clean-context deployment tests cover initialisation, preview, accept, exact verify, and rotation without exposing values.

Non-goals

• A generic secret manager integration.
• Arbitrary per-service environment editing.
• Replacing product-owned configuration validation.

[jeremi]

Triage 2026-09-05: this issue predates #716 (2026-08-12), which removed Relay V1 and registryctl, and Notary was retired earlier. The action-scoped environment model targets Relay and Notary one-shot actions inside registryctl-generated deployments, none of which exist on main. Recommend closing, or restating the invariant for the current products if it still applies.

Labeled needs-jeremi-decision rather than closed, since the underlying intent is a product call.