fix(cloud-agent-next): stop deploy from wiping control-plane enrollment

[kilo-code-bot]

Summary

• Omit CONTROL_PLANE_IDS and WORKTREE_CREATION_ENABLED_IDS from production wrangler.jsonc vars so Cloudflare dashboard allowlists survive deploy (same pattern as PER_SESSION_SANDBOX_ORG_IDS).
• Keep wrangler dev and .dev.vars.example defaulted to * so local control-plane and worktree creation stay enabled.

Test plan

• pnpm exec vitest run src/callbacks/queue-config.test.ts in services/cloud-agent-next
• After merge, confirm a dashboard-set production allowlist is not cleared on the next Worker deploy

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Omitting production wrangler enrollment vars matches the existing dashboard-preserve pattern and fail-closed runtime, with high confidence.

Files Reviewed (5 files)

• ENVIRONMENT.md
• services/cloud-agent-next/.dev.vars.example
• services/cloud-agent-next/src/callbacks/queue-config.test.ts
• services/cloud-agent-next/worker-configuration.d.ts
• services/cloud-agent-next/wrangler.jsonc

---

_{Reviewed by grok-4.6 · Input: 58.4K · Output: 8.7K · Cached: 349.2K}

_{Review guidance: REVIEW.md from base branch main}