Lazurio builds report the dev channel, so the managed policy accepts a user-set override path #177

Found by the independent review of the v0.1.7 rebuild (#172, PR #174). It is recorded here and not fixed in the rebuild. See "Why not in the rebuild" below.

What happens. From v0.1.7 the managed policy reads an alternative file from T3CODE_DEV_MANAGED_POLICY_PATH when the build's telemetry channel is dev (apps/server/src/policy/ManagedPolicy.ts:176-183). Upstream's comment there says that release builds never do this, because any override a user can set is a way around the policy. The channel comes from T3CODE_TELEMETRY_CHANNEL at build time and defaults to dev (apps/server/vite.config.ts:24). Upstream's own release workflows set it only when github.repository == 'pingdotgg/t3code' and fall back to dev everywhere else (.github/workflows/release.yml:582, release-desktop.yml:354). lazurio-release.yml does not set it either. So every Lazurio T3 Code build reports dev and accepts the override.

Impact today. None on Lazurio Environments, because Lazurio installs no policy file (/etc/t3code/policy.json on Linux). It would matter if Lazurio ever relied on a policy, for example to lock providers: anyone who can set the server's environment could point the policy at a file of their own. The runbook now states this (row 18 in docs/operations/lazurio-fork-release.md, head 2b57a5ec0e of PR #174).

Why not in the rebuild. Setting T3CODE_TELEMETRY_CHANNEL in Lazurio's builds would close the override, but it would also label the fork's telemetry as upstream's latest or nightly channel. Upstream keys channels to its own repository on purpose. A separate gate is safer, and no Environment needs it yet.

Proposed fix (for when a policy is used).

1. Ignore T3CODE_DEV_MANAGED_POLICY_PATH in Lazurio's release builds through a build-time flag set by lazurio-release.yml (preview and stable), without touching the telemetry channel.
2. Add a test showing that a release build with the variable set still reads only the system path.
3. Add a contract-test line in scripts/lazurio-release-contract.test.mjs that pins the flag in the release workflow.

Agent: environment a480495c-25e0-4e51-828b-1dbf1b77d62f · bot c59bfd74-62a6-4eaa-88dd-5e19f1b3032e