feat(DEN-1462): export deterministic conflict-safe mise configuration

[ORESoftware]

Scope

Adds zed env export mise for projecting a schema-v2 EnvironmentPlanV2 into deterministic project-local mise TOML without invoking mise, loading global state, or executing project code.

Modes

zed env export mise --plan zed-env.toml
zed env export mise --plan zed-env.toml --output .mise.toml --check
zed env export mise --plan zed-env.toml --output .mise.toml --write

• no mode flag prints deterministic TOML without mutation;
• --check verifies exact bytes and reports digest-only drift;
• --write uses ProjectTransaction and .zed/mise-export-state.json for recoverable ownership and conflict detection;
• --check and --write are mutually exclusive;
• every flag participates in the flags-2-env contract.

Supported projection

• ordered single/multi-version tools
• backend-qualified keys and core aliases
• version/path/prefix/ref selectors
• typed backend options and OS constraints
• scalar environment values and typed vars
• task descriptions, aliases, ordered command arrays, dependency classes, env/vars/tools, paths, one shell string, usage, confirmation, cache, timeout, and output flags
• lockfile platforms

Fail-closed behavior

No field is silently discarded. Exact diagnostics reject activation hooks, system-package translation, manager provenance/extensions, lock-only resolved/source/checksum state, complex env directives, structured/grouped run entries, shell argument vectors, suspicious literal secret fields, path escape, and symlink traversal.

Ownership and security

• absent output can be created;
• byte-identical existing output can be safely adopted;
• differing unowned files are never overwritten;
• edited owned files are never overwritten;
• state contains only schema, project-relative paths, and SHA-256 identities;
• no timestamps, random identifiers, absolute paths, secrets, or environment values are persisted in state;
• plan identity is domain-separated canonical SHA-256;
• output identity is SHA-256 over exact generated bytes.

Tests

Unit and real CLI tests cover deterministic ordering, typed state, print/write/check/no-op, hand-edited and unowned files, digest-only drift, secret rejection, unsupported lock-only fields, structured task boundaries, path/drive/UNC/symlink rejection, and clap ambiguity.

A permanent Ubuntu 24.04/macOS 15/Windows Server 2025 workflow runs formatting, flags-model tests, module tests, real CLI tests, all-target Clippy with warnings denied, and repeated determinism/conflict canaries.

Deliberate next steps

Complete current mise.lock export and native EnvironmentLock translation remain DEN-1461. Structured mise run-entry and sandbox mapping remain separate certified additions; this PR does not invent unsafe approximations.

Linear: DEN-1462, DEN-1461, DEN-1481

zed-pkg is independent of and unrelated to the Zed editor.

[linear-code]

DEN-1462

[ORESoftware]

Superseded by the current-main replacement PR #131.

#131 is the active merge target and composes the deterministic mise exporter, ownership/state model, flags/docs/tests, and the hardening from #115 onto current main. The reviewed source history remains available and is preserved by the replacement; this stale base should not merge independently or keep scheduling duplicate repository-wide checks.