fix(gateway): read platform env overrides through the profile secret scope (#50094 salvage)

[teknium1]

Summary

Multiplexed secondary profiles now read their own platform tokens: gateway/config.py::_apply_env_overrides routes all ~174 env reads through a scope-aware _getenv() that prefers the active profile secret scope and falls back to legacy os.environ only when no scope is installed.

Salvages #50094 by @izumi0uu (cherry-picked, authorship preserved). Fixes the root cause of #50051 / #52446 / #49415 / #54675.

Root cause: phase 2's fail-closed credential isolation covered runtime_provider and hermes_cli/config.py, but gateway/config.py never learned about agent.secret_scope. The multiplexer loads each secondary profile's config inside _profile_runtime_scope — which installs the profile's .env as a contextvar without touching os.environ — so load_gateway_config() read the PRIMARY profile's TELEGRAM_BOT_TOKEN/DISCORD_BOT_TOKEN/etc. for every profile. The profile's own tokens were never seen; the collision guard then refused the duplicate and killed the secondary adapter.

Changes

• gateway/config.py: new _getenv/_getenv_str/_getenv_int helpers — scoped read when current_secret_scope() is installed, legacy os.environ otherwise (crash-safe for the ~15 unscoped load_gateway_config() call sites in run.py, unlike the competing blanket-get_secret approaches); _apply_env_overrides swept to use them; boolean reads use the shared is_truthy_value helper
• tests/gateway/test_config.py: regression test proving a scoped secondary profile resolves its own DISCORD_BOT_TOKEN and does not inherit the default profile's API_SERVER_ENABLED
• Stripped from the original PR: an unrelated nested gateway: section merge + its test — that fix ships separately (fix(gateway): read multiplex_profiles from nested gateway section #51372 salvage, next in this cluster)
• scripts/release.py: AUTHOR_MAP entry

Validation

	Before	After
Secondary profile, token in profile .env	reads primary's token → collision guard kills adapter	reads own token, adapter starts
Unscoped load_gateway_config() (single-profile)	os.environ	os.environ (unchanged)
tests/gateway/test_config.py + test_multiplex_credential_isolation.py	—	94/94 pass

Second PR in the multiplex isolation cluster, after the adapter-routing sweep (#59310).

Infographic

[alt-glitch]

This was generated by AI during triage.

Salvage of #50094 (@izumi0uu, earliest open). Related open work in the multiplex profile-secret-scope cluster: #55277 / #51115 (platform-token facet, both dup of #50094), #52399 (API_SERVER facet), #59076 (email-adapter facet). Marked related_to (salvage, not duplicate) — a maintainer should pick between this salvage and the open predecessors for the platform-token facet. Config-gated to gateway.multiplex_profiles and scoped to the operator's own gateway (all profiles inside the trust envelope), so priced P2 per the cluster tier.