varlock: verify the transcription provider contract and env-check workflow

[WalksWithASwagger]

Parent: https://github.com/WalksWithASwagger/kk-kb/issues/2453

Goal

Make the existing Varlock contract and env-check workflow dependable for local and agent-driven development.

Scope

• Work from a clean origin/main worktree.
• Reconcile the schema from committed examples and code references only.
• Normalize the existing env-check command around agent-safe Varlock output.
• Add one documented varlock run --inject vars -- ... command for a non-production smoke path.
• Keep public issue and documentation text free of secret inventory and local machine paths.

Acceptance Criteria

• Active provider/transcription configuration is covered or intentionally external.
• The env-check workflow uses redacted output.
• Claude Code and Codex share the same safe operating instructions.
• Existing tests pass.
• No value, provider setting, local path, or ignored env file is exposed or changed.

Verification

make env-check
varlock audit
varlock scan --staged

Stop Rules

• Do not read, print, reveal, copy, rotate, encrypt, or move real secret values.
• Do not open real .env files; derive the contract from schemas, examples, code references, and platform variable names only.
• Do not update GitHub, Vercel, Codex, Claude, Cloudflare, or other provider values.
• Do not deploy.
• Stop with a concise blocker if redacted validation requires a human unlock or a missing value.

[WalksWithASwagger]

Wave 1 worker started in an isolated worktree from origin/main. Scope is limited to schemas, wrappers, documentation, and agent-safe redacted checks. No real env files, secret values, encryption, provider settings, deployments, or human-gated work are in scope. A PR or precise blocker will be linked here.

[WalksWithASwagger]

Draft PR is open from codex/issue-63-varlock-runtime-contract. All repository tests pass (324), along with docs, lint, the credential-free eval, diff checks, and gitleaks. The three Varlock CLI checks remain explicitly parked because this isolated worktree has no Varlock binary.