[RAPTOR-19721] feat(workload): take the .env flags on up as well as config

[wojtekwdr]

RATIONALE

dr workload up already reads .env: with no manifest it runs the wizard, which classifies the file, mints the credentials and writes them in. The second run was the only one that could not, so the file a deploy reads was something you had to leave the command to change.

CHANGES

• dr workload up --import-env and dr workload up --update-env do the same two edits as part of a deploy, so adding a variable or rotating a key is one command rather than two.
• Both stay opt-in, which keeps a deploy a function of the committed repo: without them the run reads nothing but the manifest, so a fresh CI clone with no .env deploys exactly what a working copy deploys.
• The edit runs before the plan, so the plan and the deploy carry the file as edited. --dry-run previews it, writes nothing, and says the plan below is for the manifest as it stands.
• A deploy that only re-sent secrets replaces no container, so it says the workload still serves the old value and names the restart, instead of reporting it as up to date and leaving it there.
• The up envelope gains an env block: keysAdded, valuesUpdated, secretsRotated, secretsNotRotated, secretsPending.

TESTING

task test and task lint pass. Exercised against a live instance: up --import-env minted the credential, added both variables, planned them as spec changes that keep the running image, rolled out with no rebuild in about 90 seconds, and the container logs show both. up --update-env with nothing else to do re-sends the secret and prints the restart advice rather than a bare "Already up to date".

NOTES

Third of a stack of three. Merge after the --update-env PR.

[wojtekwdr]

Moved to datarobot-oss/cli.