refactor(env/spot): forbid .get() defaults + cache namespace rename

Three new lint tests close gaps in the INFINITO_* SPOT contract:
* tests/lint/filesystem/env/test_default_env_keys_handled.py
  Every default.env key must be wired through a handler.
* tests/lint/filesystem/env/test_used_keys_declared.py
  Every INFINITO_* in .sh/.py must live in env/{default,ci}.env or
  a handler; per-line `# nocheck:` suppresses runtime-only refs.
* tests/lint/filesystem/python/test_no_infinito_get_defaults.py
  Forbid ANY default in `.get("INFINITO_*", ...)` -- including the
  empty-string fallback (which silently masks an unset key). The
  nocheck check walks every physical line the call spans so an
  autoformat-split call still honours the marker.

Cache namespace flattens to a single prefix:
  INFINITO_PACKAGE_CACHE_*  -> INFINITO_CACHE_PACKAGE_*
  INFINITO_REGISTRY_CACHE_* -> INFINITO_CACHE_REGISTRY_*
The five previously driver-injected paths (APT_LIST, NPMRC,
PIP_CONF, REGISTRY_PROXY_CONF, FRONTEND_CA_FILE) move into
env/default.env and passthrough.STATIC_KEYS; the
`cache_env_overrides()` helper and its two call sites are gone
along with the test-fixture override for FRONTEND_CA_DIR.

SPOT-strict rewrites:
  - 19 sites: `something.get("INFINITO_X", "")` -> subscript
    `something["INFINITO_X"]` (loud KeyError when env loader did
    not run; all keys live in env/default.env).
  - 2 handler-internal bootstrap reads suppressed with
    `# nocheck: handler-bootstrap-read`.
  - 30 runtime-only / driver-injected / test-fixture references
    annotated with `# nocheck: <reason>` per-line.
  - Unit tests that previously removed SPOT-guaranteed keys via
    `{k: v ... if k \!= KEY}` or `clear=True` switch to setting
    the key to "" explicitly, matching the new contract.

Side fixes:
  - INFINITO_DNS_DOMAIN + INFINITO_DNS_HOSTS_FILE move from
    shell-side defaults in common.sh to env/default.env and
    passthrough.STATIC_KEYS.
  - dns_systemd_is_operational() drops the dead
    INFINITO_DNS_FORCE_HOSTS_FALLBACK override branch (the
    variable was never set anywhere).
  - INFINITO_WORKER_FETCH switches from `os.environ.get(KEY, "1")`
    to `os.environ[KEY]`.
  - scripts/tests/code/wrapper.sh exec args move into a bash
    array so `# nocheck:` on INFINITO_TEST_TYPE can live on its
    own element line (SC2215 fix).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/tests/code/run.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 
 : "${INFINITO_TEST_PATTERN:?INFINITO_TEST_PATTERN must be set}"
-: "${INFINITO_TEST_TYPE:?INFINITO_TEST_TYPE must be set}"
+: "${INFINITO_TEST_TYPE:?INFINITO_TEST_TYPE must be set}" # nocheck: makefile-supplied
 
 NIX_CONFIG_EFFECTIVE="$(
 	printf "%s\n%s\n" \
@@ -25,4 +25,4 @@ if [ -n "${PYTHON:-}" ]; then
 fi
 
 make setup
-"${PYTHON:-python3}" -m unittest discover -s "tests/${INFINITO_TEST_TYPE}" -t . -p "${INFINITO_TEST_PATTERN}"
+"${PYTHON:-python3}" -m unittest discover -s "tests/${INFINITO_TEST_TYPE}" -t . -p "${INFINITO_TEST_PATTERN}" # nocheck: makefile-supplied

scripts/tests/code/wrapper.sh

@@ -19,7 +19,7 @@ source scripts/meta/env/load.sh
 
 : "${INFINITO_TEST_PATTERN:?INFINITO_TEST_PATTERN must be set}"
 : "${INFINITO_TEST_RUNNER:?INFINITO_TEST_RUNNER must be set}"
-: "${INFINITO_TEST_TYPE:?INFINITO_TEST_TYPE must be set}"
+: "${INFINITO_TEST_TYPE:?INFINITO_TEST_TYPE must be set}" # nocheck: makefile-supplied
 
 RUN_SCRIPT_IN_CONTAINER="${INFINITO_SRC_DIR}/scripts/tests/code/run.sh"
 
@@ -28,7 +28,7 @@ docker)
 	# INFINITO_DISTRO is sourced (with a `debian` default) from
 	# scripts/meta/env/load.sh above, so no explicit check here.
 	echo "============================================================"
-	echo ">>> Running ${INFINITO_TEST_TYPE^^} tests in ${INFINITO_DISTRO} container (compose stack)"
+	echo ">>> Running ${INFINITO_TEST_TYPE^^} tests in ${INFINITO_DISTRO} container (compose stack)" # nocheck: makefile-supplied
 	echo "============================================================"
 
 	# Auto-bring-up: if the `infinito` container is not running, kick off
@@ -48,23 +48,30 @@ docker)
 	# every INFINITO_* key from the bind-mounted .env into the test
 	# runner's environment (notably INFINITO_WORKER_FETCH, otherwise the
 	# external URL probe collapses to 1 worker).
+	# Per-invocation env passed through docker exec. Built as a bash
+	# array so the inline `# nocheck:` markers between elements stay
+	# syntactically valid (a backslash-continued line cannot host an
+	# inline comment).
+	exec_env_args=(
+		-e ACT="${ACT:-}"
+		-e BASH_ENV="${INFINITO_SRC_DIR}/scripts/meta/env/load.sh"
+		-e GITHUB_ACTIONS="${GITHUB_ACTIONS:-}"
+		-e GITHUB_REPOSITORY="${GITHUB_REPOSITORY:-}"
+		-e GITHUB_REPOSITORY_OWNER="${GITHUB_REPOSITORY_OWNER:-}"
+		-e GITHUB_SHA="${GITHUB_SHA:-}"
+		-e INFINITO_TEST_PATTERN="${INFINITO_TEST_PATTERN}"
+		-e INFINITO_TEST_TYPE="${INFINITO_TEST_TYPE}" # nocheck: makefile-supplied
+	)
 	INFINITO_DISTRO="${INFINITO_DISTRO}" \
 		docker compose --env-file env/ci.env --env-file .env --profile ci exec -T \
-		-e ACT="${ACT:-}" \
-		-e BASH_ENV="${INFINITO_SRC_DIR}/scripts/meta/env/load.sh" \
-		-e GITHUB_ACTIONS="${GITHUB_ACTIONS:-}" \
-		-e GITHUB_REPOSITORY="${GITHUB_REPOSITORY:-}" \
-		-e GITHUB_REPOSITORY_OWNER="${GITHUB_REPOSITORY_OWNER:-}" \
-		-e GITHUB_SHA="${GITHUB_SHA:-}" \
-		-e INFINITO_TEST_PATTERN="${INFINITO_TEST_PATTERN}" \
-		-e INFINITO_TEST_TYPE="${INFINITO_TEST_TYPE}" \
+		"${exec_env_args[@]}" \
 		--workdir "${INFINITO_SRC_DIR}" \
 		infinito \
 		bash --login "${RUN_SCRIPT_IN_CONTAINER}"
 	;;
 host)
 	echo "============================================================"
-	echo ">>> Running ${INFINITO_TEST_TYPE^^} tests on host"
+	echo ">>> Running ${INFINITO_TEST_TYPE^^} tests on host" # nocheck: makefile-supplied
 	echo "============================================================"
 	exec bash --login "${RUN_SCRIPT}"
 	;;