fix(cli): flag a .env that lives inside the installed package

[maxmad64bis]

⚠️ base-red inherited: #9985

Summary

The CLI prints one line per env file it loads — 📋 Loaded env from … — without saying which of those locations survives an update. One of them does not: the installed package directory is replaced wholesale by npm i -g, so an operator who edits the .env the CLI just named loses those values at the next update, and nothing warns them at any point, before or after.

This adds one line when that happens, naming the durable path to move the values to.

It fires only when both conditions hold: the file sits inside a package under node_modules, and it actually supplied at least one value. The loader is first-writer-wins, so a file entirely shadowed by a durable one supplied nothing and costs nothing to lose. A development checkout is therefore silent — there the same path is stable, and docs/guides/SETUP_GUIDE.md documents it.

The decision lives in a pure module so it can be tested without booting the CLI, the way parseEnvValue.mjs was extracted for the same reason in #10101.

Related Issues

• Closes # — none open on this.
• Related to fix(cli): stop pre-filling the secrets the server owns #11436, which stops postinstall from filling the server-owned secrets in that same file. This one covers the installs already carrying a filled .env there, which that fix cannot empty retroactively.

Validation

• Change type: CLI — startup env loading only
• Focused tests and category gates from the golden path (CLI)
• npm run lint
• Reconciled with the current active release base; focused checks rerun afterward
• Production-code changes include a new or updated automated test in this PR

$ node --test tests/unit/cli-volatile-env-path.test.ts tests/unit/sync-env.test.ts \
    tests/unit/cli-data-dir-env.test.ts
# tests 12
# pass 12
# fail 0

$ npm run check:pack-policy
✅ Pack artifact policy check passed.

$ npx eslint bin/omniroute.mjs bin/cli/utils/volatileEnvPath.mjs \
    tests/unit/cli-volatile-env-path.test.ts
(clean, no errors)

Run from a checkout, the CLI prints its usual Loaded env from lines and nothing else — the flag-off case, in effect.

Tests Added Or Updated

• tests/unit/cli-volatile-env-path.test.ts (new) — five cases on the pure decision: an installed package .env that supplied keys is reported, and the message names the durable path; a development checkout is silent; a file that supplied nothing is silent; the durable file itself is silent wherever it sits; a path outside the package root is silent.

Coverage Notes

Two production files. bin/cli/utils/volatileEnvPath.mjs is covered line by line by the five cases above. The wiring in bin/omniroute.mjs is six lines inside loadEnvFile() that pass the resolved paths and print the result; loadEnvFile() runs at import time and is not unit-testable as such, which is exactly why the decision was extracted.

Reviewer Notes

• Nothing behavioural changes for a checkout, a Docker install, or any install whose package .env supplied no value. The new line is a console.warn on an existing warning path, next to the shadowed-key warnings already printed there.
• The condition is anchored on the resolved package root, not on the working directory. addEnvPath() dedupes by exact path, so running the CLI from inside the package directory collapses to the same entry — and the warning is correct there anyway, that file being just as volatile.
• The message names <dataDir>/.env, resolved the same way the loader resolves it, so it is actionable without reading any documentation.