fix(cache): exclude untrackedEnv names from tracked bulk env queries

[simulacre7]

Closes #505

Problem

A tracked bulk env query (getEnvs) was validated against the full unfiltered parent environment, so a broad query — an empty prefix matches every variable — cache-missed whenever any ambient variable changed. On GitHub Actions, per-run variables like ACTIONS_ORCHESTRATION_ID made such tasks miss every run.

Where the fix belongs (answering the issue's question)

The issue asked whether to validate against the filtered env the task received. I didn't do that: the runner serves getEnv/getEnvs from the unfiltered plan env context by design (CacheMetadata::unfiltered_envs), and validation must stay consistent with what served the original request — switching both to the filtered view would change what values tools see (e.g. Vite's env loader would stop seeing undeclared ambient VITE_* vars).

Instead, this extends the existing untrackedEnv contract to bulk queries. For spawn-env filtering, untrackedEnv already means "passed through, but not fingerprinted". Bulk queries now honor the same declaration:

• Record: names matching the task's untrackedEnv patterns are excluded from the stored match-set (collect_tracked_env_queries).
• Validate: the same exclusion is applied to both the current and the stored side (PostRunFingerprint::validate). Filtering the stored side too lets entries recorded before this change keep hitting instead of forcing a one-time miss. The untracked config participates in the spawn fingerprint, so the pattern set at validation time matches the one at record time.
• Serving is unchanged: the runner still returns untracked variables to the tool; a hit replays the recorded output, per the untracked contract.
• Explicit single-name getEnv reads stay fingerprinted: naming a variable is a direct dependency declaration by the tool, unlike a broad sweep.

Also adds ACTIONS_* to DEFAULT_UNTRACKED_ENV next to GITHUB_*/RUNNER_* — that's the family the reproduction's ACTIONS_ORCHESTRATION_ID belongs to.

Test plan

• New unit tests in fingerprint.rs: current-side exclusion, stored-side exclusion (pre-change entries), and a contrast test that a genuinely tracked match change still misses.
• New e2e case fetch_envs_tracked_query_ignores_untracked_names in the ipc_client_test fixture: ambient noise matching untrackedEnv appears/changes → cache hit; tracked match changes → miss (snapshot shows the runner still serving the noise variable on the miss).
• Existing ipc_client_test cases: 21/21 pass unchanged (no snapshot churn).
• cargo test (workspace): all 15 test binaries pass. cargo clippy -p vt -p vt_graph --all-targets clean, cargo fmt --check clean.
• Not verified: the original reproduction repo drives this through vp, which bundles vite-task as a git dependency, so I couldn't point it at this branch directly. The new e2e case models the same mechanism (broad tracked query + volatile ambient variable).

🤖 Generated with Claude Code