fix(config): interpolate env() refs before schema decode

[Coly010]

Fixes the crash when supabase/config.toml uses env(VAR) on numeric or boolean fields (e.g. analytics.port = "env(SUPABASE_ANALYTICS_PORT)"). The strict Effect Schema decode ran immediately after raw TOML parse, with interpolateValue in project.ts only firing post-decode via resolveProjectValue — so it never got the chance to substitute the string before Schema.Number rejected it.

What changed

• Pre-decode env() interpolation in packages/config/src/io.ts — loadProjectConfigFile now loads the project environment (.env/.env.local/ambient) and runs a schema-aware walker on the parsed document before handing it to Schema.decodeUnknownSync(ProjectConfigSchema).
• Schema-aware walker in packages/config/src/lib/env.ts — traverses both the parsed document and ProjectConfigSchema.ast in parallel. For string leaves matching env(VAR): substitutes against the env, then coerces to Number/Boolean if the schema at that path expects one. Mirrors Go's LoadEnvHook + mapstructure type chain (apps/cli-go/pkg/config/decode_hooks.go:14-21 → subsequent string→type conversion hooks).
• Verbatim-on-missing semantics — interpolateLeafValue in project.ts no longer throws MissingProjectEnvVarError when the referenced env var is unset. It returns the literal env(VAR) string, matching Go parity. The MissingProjectEnvVarError class and re-export are removed; resolveProjectValue / resolveProjectSubtree no longer have a failure channel.
• Fields declared with the env() schema helper opt out via the x-env-deferred marker annotation. They still require the literal env(VAR) format for post-decode resolution by resolveProjectValue — the walker honors the marker and leaves those paths untouched.

Reviewer-relevant context

• No schema-file edits. Coercion lives entirely in the walker, so future fields added to any of the section schemas (db.ts, analytics.ts, auth/*.ts, etc.) automatically work with env() references — no risk of a contributor forgetting to use a coerced primitive at declaration time.
• The marker annotation lives on the check, not the outer AST. env() = Schema.String.check(isPattern(envRegex)).annotate({...}) attaches metadata to the resulting Filter rather than the base String AST, so isDeferredEnvField inspects both node.annotations and node.checks[].annotations. Caught by the @supabase/stack functions.unit.test.ts regression for functions.<name>.env (env() helper at a record value position).
• Missing-env semantics in project.ts are now non-failing. Two existing "fails when missing env var" tests in project.unit.test.ts:223,255 are rewritten to assert verbatim preservation. redactValue already skips redaction when the value is still an env reference (!isEnvReference(value)), so unresolved literals flow through as plain strings — no Redacted wrapping on missing secrets.
• The next/projectContextLayer workaround (PR refactor(cli): remove rawProjectConfig from ProjectContext #5281) is left in place. That layer dropped the loadProjectConfig call entirely to avoid the crash; reintroducing it is a follow-up refactor since the workaround still functions correctly (it only loads env, not config).
• The existing CLI-1489 regression test at apps/cli/src/next/config/project-context.layer.unit.test.ts:30 is not modified — it asserts the workaround-era behavior of projectContextLayer, which is unchanged. Direct upstream regression coverage is added in packages/config/src/io.unit.test.ts: numeric coercion, boolean coercion, verbatim preservation, ambient fallback, and decode failure when an unset var is referenced from a numeric field.

Fixes CLI-1489