feat(seats): the env file's settings count, and a machine's own seats file

ApiConfig and PoolConfig read the seat order, the budgets and the
concurrency from the process environment alone, so a `.env` that said
REVIEW_GATES_SEAT_ORDER=oauth-first ordered nothing: the Python driver
reads those lines from the file under the process environment
(config_env, 2026-10-17: a setting lives beside the seats it orders).
SeatPool::SettingsOf does the same - the file's placement settings
under the process environment, in a map handed to the placement readers
alone (ApiConfig, PoolConfig, Seats::ConfigFromEnv) - and leaves the
process environment untouched, so no other reader sees a line of the
file: a path's or a binary's line reaches nothing, and two drivers
reading one .env keep one board and one ledger. The placement settings
are one list, SeatPool::PlacementSettings - the fifteen names those
readers read - for the map, the run's log and what makes a working
directory's .env a seats file; a REVIEW_GATES_* line of any other name
stays out of the map and is named, by the run's log and on `seats`'s
stderr. One dotenv grammar serves the tokens and the settings
(Seats::DotenvLines).

`run` and `seats` resolve the file from their own --env-file
(SeatPool::ResolveSeatsFile): the --env-file, else $SEATS_ENV_FILE, else
the working directory's .env - the operator's, as the Python driver and
`seats` read it, not the repository under review's - when it is a file
holding a seat or a placement setting, each with a value, or one that
cannot be read as UTF-8 text (its error is then the command's) - a
readable application .env, its Vite or Supabase lines, one of blank
placeholder lines or one that is no file is passed over, and the run
says so - else the machine's own
$XDG_CONFIG_HOME/crafter-review/env, else ~/.config/crafter-review/env:
one file for every repository on a machine, a repository's seats .env
winning over it. Each file is read once and the settings and the tokens
are taken from that read (SeatsFile::Text), so a file that can be read
only once - a pipe, `--env-file <(gpg -d seats.env.gpg)`, a FIFO - gives
its settings and its seats alike, and a failed read raises its own error
where the tokens are laid over the environment: SeatPool::WithFileTokens,
for `run` and `seats` alike, and LoadSeats takes the merged environment
and no longer reads a file by path. An empty `seats --env-file` means no file
now, as it did for `run`, and the `seats` report names the side that
runs first (it said "api seats run first" whatever the order).

Runs, Commands and KernelModes, the tests that run `run` and `seats`,
point XDG_CONFIG_HOME, and HOST_XDG_CONFIG_HOME for the Flatpak, at a
path of their own that nothing creates, so a global file stays out of
them; the grammar, the settings and their precedence, the lookup and the
one read have their tests, a run with `--env` (a prefix) and with a
repeated --env-file, and a `seats` with `--env`, take tokens and
settings from the one file, an application's .env and a venv are passed
over, a FIFO is read once, no line of the file reaches `stop`, every
listed placement setting moves a reader, another REVIEW_GATES_* line is
named and a .env of blank lines passed over, and the
README, the environment table and the procedure say the new rule.

process/prepush.md

@@ -298,11 +298,23 @@ flatpak run net.catcrafts.CrafterReview run --artifact .review-gates/push/<slug>
   [--context-paths <dirs>] --date <YYYY-MM-DD>
 ```
 
-The lens processes run on the seats in the repository's `.env`
-(`CLAUDE_CODE_OAUTH_TOKEN1..6` Max plans, `ANTHROPIC_API_KEY1..6` API-credit
-organisations: API seats first, up to `REVIEW_GATES_API_BUDGET_USD` per seat
-per cycle, then OAuth seats by 5-hour headroom), else this machine's own
-login; `flatpak run net.catcrafts.CrafterReview seats` reports them. An API seat is safe only
+The lens processes run on the seats of a dotenv file: `--env-file`, else
+`$SEATS_ENV_FILE`, else the working directory's `.env` when it is a file
+holding a seat or a placement setting, or one that cannot be read as
+UTF-8 text (the run then stops at preflight with the read error; a
+readable application `.env` is passed over), else this machine's own
+`~/.config/crafter-review/env` (`$XDG_CONFIG_HOME/crafter-review/env`).
+Its seat lines go over the process environment's; with no seat in either,
+this machine's own login. The seats are `CLAUDE_CODE_OAUTH_TOKEN1..6` Max
+plans, placed by 5-hour headroom (weekly headroom where Anthropic has
+removed the 5-hour limit), and `ANTHROPIC_API_KEY1..6` API-credit
+organisations, up to `REVIEW_GATES_API_BUDGET_USD` per seat per cycle; API
+seats go first unless `REVIEW_GATES_SEAT_ORDER=oauth-first`. The placement settings among the file's
+lines (the seat order, the budgets, the concurrency, the utilisation
+ceilings) count where the process environment has none; any other
+`REVIEW_GATES_*` line - a path, a binary - is not taken, and the run and
+`seats` name it.
+`flatpak run net.catcrafts.CrafterReview seats` reports them. An API seat is safe only
 when its organisation holds nothing but the plan's monthly credits — no
 payment method, no purchased credits, auto-reload off — so that "credit
 balance is too low" is a hard stop. `--seats local|api|oauth|<list>`,