Add tests for dotenv.ml credential loading

[usurobor]

Parent: #23
Labels: test, P3
Priority: P3 — no existing test coverage for the v0.4.0 feature shipped in engine/ocaml/lib/dotenv.ml.

Problem

engine/ocaml/lib/dotenv.ml (shipped in v0.4.0, commit b522aa3) has no automated tests. The feature provides credential loading from .tsc/.env with permission checking and real-env precedence. These behaviors are not validated by any test.

Evidence

• v0.4.0 PRA §6 (cycle Sub 4 (#23): Retroactive close-out for v0.4.0 release #27) listed dotenv tests as a deferred output.
• γ close-out cycle Sub 4 (#23): Retroactive close-out for v0.4.0 release #27 filed this as project MCI.

Acceptance criteria

AC1: Permission check tested

Test that loading .tsc/.env with permissions other than 0600 produces a warning (or refusal, per the implemented behavior).
Oracle: OCaml test suite passes with a case covering world-readable .env file.

AC2: Real-env precedence tested

Test that when both .tsc/.env and the process environment contain the same key, the process environment value wins.
Oracle: OCaml test suite passes with a case covering env-wins scenario.

AC3: File-absent case tested

Test that when .tsc/.env does not exist, no error is raised and env vars are loaded from the process environment normally.
Oracle: OCaml test suite passes with a case covering absent .env file.

AC4: Key-from-file case tested

Test that when a key exists in .tsc/.env and not in the process environment, it is loaded from the file.
Oracle: OCaml test suite passes with a case covering file-only key.

Non-goals

• Testing LLM provider integration (live network calls).
• Changing the dotenv.ml implementation.

Skills to load

• cdd/alpha (implementation)

Priority

P3 — quality gap; no active regression but untested credential loading is a future maintenance risk.