Align template and inline environment initialization

[SaladDay]

A Session that referenced an Environment Template previously rejected inline env, files, setup commands and packages. It now composes those fields according to owned official API observations on the fixed 3.13.0 baseline: env overlays by key, files and commands replace complete lists, and packages select per manager. Omission/null inherits and an explicit empty list clears its field.

Composition reuses the shared resolver, validators and encrypted Session transaction. Caller intent remains distinct from frozen configuration, so retries survive template/source deletion without changing committed initialization. There are no Runtime, Provider, adapter or schema-migration changes.

Validation

• Owned official SDK/raw HTTP probes: 86 requests, nine Sessions, six real model Turns; cleanup and credential scans retained. Official package results are metadata evidence, not independent installation verification.
• API and contract tests; independent fixed-SDK/raw HTTP/PostgreSQL acceptance for composition, ciphertext, tenant isolation, rollback and frozen retries.
• Every required make check target passed: fresh server non-Web gate at 5589df0 (real PostgreSQL, sqlc byte comparison, builds and native checks), plus fresh Web gate with 287 client, 583 Web and 76 browser tests. OpenAPI regenerated. Real Codex/Docker acceptance used the exact 8019ac5 production build and three completed Kimi Turns: populated inline effects, then inherited configuration before/after template mutation/deletion and Core restart, with no repeated initialization. Earlier private deployment/assertion mistakes and raw evidence are preserved in the coverage record.

Null network and other unqualified list semantics remain outside this batch. This is bounded protocol alignment, not full compatibility.

Fresh independent GPT-6 Astra high blind review covered all 11 files and acceptance evidence, with no actionable findings. Owned test resources were cleaned up; skipped optional native probes and retained fixture failures are documented.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}