feat(cli): migrate --runtime/--no-redact/--log-level to clap-native env=

[pofallon]

Summary

Category B of #180 (part 1 of 2). Three flag-backed env vars were read by hand below the CLI layer; this moves them onto clap's env= attribute so clap owns precedence (flag > env > default) and --help advertises [env: …] for free.

Flag	Env var	Change
--runtime	DEACON_CONTAINER_RUNTIME	env= added; RuntimeFactory::detect_runtime drops its manual env branch (now flag-or-default; env resolved at CLI tier, threaded via self.runtime)
--no-redact	DEACON_NO_REDACT	env= added (clap boolish parse)
--log-level	DEACON_LOG_LEVEL	env= added — previously this var was only a doctor diagnostic and never actually backed the flag; now it does (DEACON_LOG/RUST_LOG still win for the effective directive)

Stale-issue notes

• The issue's premise that detect_runtime reads DEACON_RUNTIME is stale — it already read DEACON_CONTAINER_RUNTIME, matching what doctor reports, so the "reconcile names" item was already satisfied.
• The acceptance item "preserve the experimental-Podman warning after the detect_runtime refactor" is moot: no such warning exists in detect_runtime.

Details

• doctor's env snapshot now lists DEACON_CONTAINER_RUNTIME and DEACON_NO_REDACT for discoverability; its reads stay diagnostic (the one legitimate exception to the no-hand-rolled-read rule).
• temp-env parse tests (flag / env / flag-beats-env) per var, mirroring the DEACON_OVERRIDE_CONFIG template. The runtime.rs env-precedence tests move to the CLI layer where the env is now resolved.
• The clap-env= convention is documented in CLAUDE.md for future flag additions.

Follow-ups

• Part 2 (--log-format, --force-tty-if-json): meatier because their env reads live deep in the up flow — will thread the resolved json-mode into UpArgs (fixing a latent bug where --log-format json as a flag doesn't trigger PTY gating that only reads the env var).
• Category A (net-new env vars) tracked separately.

Testing

• cargo fmt --all -- --check ✓
• cargo clippy --all-targets --all-features -- -D warnings ✓
• make test-nextest-fast — 3095 passed, 31 skipped ✓
• --help verified to advertise [env: …] for all three.

🤖 Generated with Claude Code