docs(cli): fix stale detectMode quote in serve-process.ts header

[os-trump]

Fixes#11691

What

packages/cli/test/helpers/serve-process.ts's header quoted detectMode from
packages/services/service-settings/src/local-crypto-provider.ts with an
env.VITEST || arm that #11448 (a58eac3e) already deleted. The quoted code
no longer matched the source, and the narrative built on it predicted a
crypto-posture flip (test → development) that can no longer happen.

This is a comment-only rewrite of the "VITEST is NOT cosmetic" section:

1. States the read existed, fix(service-settings): select crypto posture from the deployment signal, never the test runner #11448 removed it, pnpm check:runner-env-posture
   now holds the class shut, and the strip in childEnv() stays anyway — as
   defence-in-depth over a gated class, not as the fix for a live product
   read.
2. Re-derives OS_SECRET_KEY's justification in runServe() from NODE_ENV,
   not VITEST: bin/run-dev.js pins process.env.NODE_ENV = 'development'
   before argv is even parsed, and NODE_ENV is deliberately outside
   childEnv()'s strip family — so every child spawned through this helper is
   already in development crypto posture, with or without a leaked
   VITEST. The old text's prediction of a posture flip was false, and had
   already propagated into another card's dispatch as the reason a set of
   serve-* spawners were expected to be the harder half of a fix.

The TEST / better-auth half of the header (isTest() reads TEST
directly) is untouched — it is still exactly true.

No executable line changed; childEnv()'s behaviour is unmodified.

Verification

• Anchored greps: stale env.VITEST || quotation is gone; new rationale
  (#11448, a58eac3e, check:runner-env-posture, defence-in-depth) is
  present.
• Re-verified independently on origin/main (not reconciled to the dispatch's
  line numbers): current detectMode source
  (packages/services/service-settings/src/local-crypto-provider.ts:185) has
  no VITEST arm; bin/run-dev.js:28 pins NODE_ENV = 'development' before
  run() is called.
• packages/cli/test/helpers/serve-process.ts's dependent e2e suites green:
  serve-process-child-env.e2e.test.ts (6/6), serve-node-env-production-default.e2e.test.ts
  • serve-boot-diagnostics.e2e.test.ts (5/5).
• pnpm --filter @objectstack/cli typecheck clean.
• Gate family re-derived with node scripts/pm/dispatch-gates.mjs against the
  actual change set (one file); matched local gates
  (check:cli-test-child-env, check:i18n, check:published-files,
  check:slot-lookup, check:test-source-alias, check:type-check-coverage,
  check:type-source-resolution, check-plugin-teardown-shape,
  check-affected-docs, check-drift-comment) run clean; pnpm lint
  full-repo run at c225c701 (see report for the exact output).
  check:i18n-coverage and check:type-check-debt --re-measure could not be
  locally re-measured in this scoped worktree (both require the FULL monorepo
  build closure, not just @objectstack/cli's dependency chain) — noted in the
  dev report; neither can move from a docblock-only edit.
• No red-before state exists for a comment-only change (expected, not
  manufactured).

skip-changeset — comment-only, no user-visible behaviour change.

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

⚠️1 changed file(s) yielded no anchor (packages/cli/test/helpers/serve-process.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

What this run could not see

• 1 changed file(s) yielded no anchor (packages/cli/test/helpers/serve-process.ts) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 23 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 2c4c59ed20caf4f6cde3c979ae9205ee69e04256 → packageMentionDocs.