DATABASE_URL: postgresql://username:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}@postgres:5432 pattern not working as dynamic env

[Hydralerne]

[Baaaki]

Opened #677 for this.

The embedded spelling (postgresql://user:${POSTGRES_PASSWORD:?...}@postgres:5432) loses the "required but unresolved" marking that the whole-value spelling keeps, so nothing downstream can tell the half-interpolated value apart from a literal the author typed. The concrete damage is in keepUnresolvedEnv: a push-deploy re-parse overwrites the working DATABASE_URL the user configured in the wizard.

The PR fixes the provenance loss and that overwrite. It does NOT make ${} dynamic — the value is still resolved once at scan time — so I've deliberately left this issue open rather than closing it with the PR.

[Hydralerne]

fixed