feat(iaci): environment axis — env-scoped overlay orthogonal to profile (#60)

[Zorlin]

Implements #60.

What

A native environment axis, orthogonal to profile:

• profile = location/site/context → selects inventory + secrets_inventory (unchanged).
• environment = env-within (prod/test/staging) → layers an env-scoped secrets overlay on top of whatever the profile selected, selected independently.

version: 1
defaults:
  playbook: playbooks/k3s/main.yml
  inventory: [labs/london]
  secrets_inventory: [../infra-secrets/london]
  environment: prod          # default env
environments:
  test:
    secrets_inventory: [../infra-secrets/london-test]

jetpack apply                       # prod (default env, no overlay)
jetpack apply --environment test    # london inv+secrets + london-test overlay
jetpack apply --profile nyc --environment test   # orthogonal

Selecting an env appends its overlay to the secrets load list (loaded last → later-wins), so an env can pin any per-env var without touching the site inventory. --no-secrets skips it; an unknown env is a clear error.

How (mirrors --profile end-to-end)

• Schema (config_file.rs): defaults.environment + environments: map + JetpackEnvironment { secrets_inventory } (Some(vec![]) clears, None inherits), surfaced in EffectiveDefaults.
• CLI (parser.rs): --environment/-E, fields + summary row.
• Application (parser.rs): env overlay appended after profile resolution; --no-secrets skips it; unknown-env errors.

Tests & verification

• 9 new tests (schema parse, overlay-appended-last, -E alias, default-env, orthogonality with --profile, unknown-env error, --no-secrets skip, empty-vec-vs-absent). 389 total green; cargo clippy clean for the new code.
• Real binary: -v shows sec/base alone without --environment; sec/base, sec/envtest + an Environment | test row with -E test.

Deferred (with reasons)

• Overlay-merge integration test (env var shadows base): relies on loading.rs's existing later-wins multi-path behavior, which the appended-overlay test already exercises at the parser level.
• Templated play.groups e2e from the issue (groups: ["{{ k3s_group_prefix }}-bootstrap"]): depends on Template play.groups — parameterize a playbook's target groups from vars #52 (unmerged) — lands with that integration.

🤖 Generated with Claude Code