List container env names only

A worker listing container env names wrote its own inspect projection, and part of a credential reached its context. The rule is that the command that fetches projects names only, so a value never leaves the rig.

just lab env-names <container> is now the one reader. gce/env-names.sh runs on the rig, over the same ssh path as the other recipes, with podman or docker. real-model status, the DWS key gate and the gateway mode probe use it instead of their own inspect calls. scripts/env-lint.sh fails CI on any other reader of container env.

flowchart LR
  A[Rig container] --> B[Inspect plus projection on the rig]
  B --> C[Names only over ssh]
  C --> D[Agent context]

Tests: a fixture shaped like inspect output yields exactly the names; the old whole-entry projection fails the same assertion; the lint is tested on each forbidden form.