feat(config): add v5-native env_path/env_from environment injection

[christso]

Summary

This is the v5-native replacement path for hooks.before_session. It adds explicit .agentv/config.yaml support for:

• env_path: string or array of dotenv-style file paths, loaded before validation/eval so {{ env.* }} references resolve. Relative paths resolve against the project directory (parent of .agentv/). A missing file warns and is skipped.
• env_from: object or array of {command: [...], format?: 'shell_exports'|'json'}, run before validation/eval. command must be a real argv array — shell command strings are rejected. format defaults to shell_exports. A failing command aborts the CLI with an error. Output values are never printed to logs.

hooks.before_session keeps running for backward compatibility but now logs a deprecation warning, and .agentv/config.yaml schema validation no longer flags hooks/env_path/env_from as unexpected fields.

Why

hooks.before_session ran an arbitrary shell command string and had no config validation support (agentv validate flagged hooks as an unexpected field). env_path/env_from give an explicit, validated, promptfoo-envPath-inspired contract for the same use case, with argv-only commands (no implicit shell) and secret-safe logging.

Notes / known limitations (documented in the docs page)

• env_path/env_from are discovered from the CLI's current working directory at startup, same as legacy hooks.before_session — a nested project's own config only applies when invoked from within that project. Follow-up tracked separately.
• A config.yaml's own fields (e.g. results.repo) are interpolated before that same file's env_path/env_from runs, so they can't reference values produced by their own env_path/env_from.

Test plan

• bun test for packages/core/test/evaluation/env-injection.test.ts (new), config-loader.test.ts, config-validator.test.ts, hooks.test.ts, providers/ — all passing
• bun test for apps/cli/test/unit/preprocess-argv.test.ts, env.test.ts — all passing
• bun run typecheck for @agentv/core and agentv — clean
• biome check on all changed files — clean
• Manual CLI UAT: agentv validate .agentv/config.yaml (deprecation warning, no "Unexpected fields"), agentv validate .agentv/targets.yaml and an eval file (env-interpolated fields resolve), agentv eval run against a mock target confirming env_path+env_from injected values flow through to {{ env.* }} interpolation
• Independent adversarial code review pass (ce-adversarial-reviewer) — found and fixed a P0 (secret fragment could leak into an error message via a malformed JSON parse error) and a P1 (validator treated an empty env_path:/env_from:/hooks: YAML key as a hard error while the loader treated it as absent); both fixed with regression tests
• GitHub Actions full suite (pending)

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying agentv with    Cloudflare Pages

Latest commit:	76bdb9a
Status:	✅  Deploy successful!
Preview URL:	https://a7730fe0.agentv.pages.dev
Branch Preview URL:	https://feature-v5-env-from-env-path.agentv.pages.dev

View logs