Workspace .env bootstrap-only entries abort dsh web startup

[Lancetwang]

Problem

dsh web discovers the .env in its invoking directory. If that file contains a bootstrap-only name such as DEEPSEEK_BASE_URL, app boot throws before the Web UI opens—even when the file belongs to another application in the same workspace.

Reproduction

# .env in the invoking directory
DEEPSEEK_BASE_URL=https://example.invalid
APP_SETTING=kept

dsh web

Current behavior: startup aborts while reading .env.

Expected behavior: refuse the protected file value, explain how to set it in the launching environment, and continue booting with accepted entries from the same file. The security boundary requires rejecting the value; it does not require rejecting the whole launch.

Suggested behavior

• Match protected names case-insensitively, as today.
• Warn once for each protected file entry and omit it from both process.env and LaunchEnvironmentSnapshot.
• Continue applying accepted entries from the project and Harness-home .env files.
• Keep inherited launch-environment values allowed.
• Add no flag or escape hatch; the command remains dsh web.

Patch

I prepared a focused patch on my fork:

• Branch: https://github.com/Lancetwang/deepseek-harness/tree/fix/tolerate-protected-dotenv
• Commit: Lancetwang@a86eb22

Verification completed: 52 focused app-boot tests; 124 related tests with 100% coverage for the changed source; lint, build, typecheck, and an unchanged-command built-CLI smoke test. Documentation sync passed 27/28 gates; the remaining Windows symlink-escape fixture could not create its test symlink on this host (EPERM).

The repository currently does not accept external PRs per CONTRIBUTING.md, so I am reporting the issue here and leaving the commit available for review or cherry-pick.