refactor(cli): cover config push runtime with effect lint (CLI-2486)

[7ttp]

TL;DR

brings the supabase config push runtime under the effect lint

whats introduced?

effect lint applied to the config push runtime:

• one allow list entry for config/push, holding back its integration, e2e and live tests until the next page
• auth email templates load through FileSystem and fail with the push load error directly, keeping a leading BOM and the same read error text
• env(VAR) secret references resolve through Config before the decrypt check, the lookup inspect already uses, so a set but empty shell variable behaves as before
• sms_test_otp_valid_until comes from DateTime, still rolling a leap day over to March 1st
• the addons status error is yielded directly and the addons body parse keeps its native message
• the project root is derived through the Path service

ref:

• related: CLI-2486

[github-actions]

🤖 AI Review

All three reported findings were verified against the checked-out code. The converted email-content tests lack the Scope required by their scoped temporary directories. The environment lookup also visits fields outside the secret check, creating an unnecessary error path. The JSON parsing wrapper is a documentation nit. The specific claim that env() causes a Config failure was not established.

Findings

Severity	Location	Category	Sources	Claim
🟠 MAJOR	apps/cli/src/commands/config/push/push.auth-email-content.unit.test.ts:56	test-setup	codex	The converted tests use scoped temporary directories without supplying Scope, so the test Effects cannot typecheck as written.
🟡 MINOR	apps/cli/src/commands/config/push/push.handler.ts:137	error-handling	claude	Environment-reference prefetch reads strings throughout the loaded document, including fields outside the secret check, and propagates a Config lookup error from any of them as a push failure.
⚪ NIT	apps/cli/src/commands/config/push/push.cost-matrix.ts:84	code-quality	claude	parseAddonsBody is an unexplained one-line JSON.parse wrapper, leaving the reason for this exception to the surrounding Effect parsing pattern unclear.

Stats

Claude findings: 2 · Codex findings: 1 · Confirmed: 3 · Refuted: 0 · Uncertain: 0

---

Models: claude-opus-5-5 + gpt-6-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.

[avallete]

Runtime rewrites stay on the old contract:

• Auth email HTML is read as bytes and decoded with ignoreBOM: true, so a leading BOM is still pushed. Read failures still surface the Node error text (ENOENT: ...).
• env(VAR) lookup prefetches through Config.option(Config.string(name)) on the live process.env record (exact key, empty strings kept) and then falls back to the project env. Same result as process.env[name] ?? projectEnv[name] for the names assertDecryptableSecrets actually resolves. Config.option does not fail on a missing name under that provider.
• sms_test_otp_valid_until uses a UTC Date copy plus DateTime.formatIso. The unit test still expects the old ISO string, including the leap-day roll to March 1.
• The addons status error is yield* on the same TaggedError (Effect.fail). parseAddonsBody is still JSON.parse.

No runtime behavior change.