fix(pm): dispatch-gates scores a command whose workflow step passes an expression through env: as NOT MEASURED, like an argv-carried one (#15761) (#15830)

* fix(pm): dispatch-gates reads the step's env: when scoring a command as value-bearing

The "takes a VALUE FROM THE WORKFLOW" detector read the `run:` argv only, so a
step that passes its input through `env:` — with a bare argv — scored as a
command a dev can paste. `.github/workflows/partof-closing-keyword-guard.yml`
is the specimen: PR_BODY / PR_NUMBER arrive through `env:` and
`node scripts/check-partof-closing-keyword.mjs` was offered as runnable, while
the gate's own refusal calls that run NOT WIRED and exits 2.

`runCommandSteps` now returns each `run:` step with the `env:` names whose
value is an Actions expression, minus the ones the command line spells for
itself (those are argv-carried and already read). `workflowEnvValues` applies
the same shape of conjunction #14004 used for the event payload, and the union
feeds the existing NOT-MEASURED bucket unchanged.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012zGPuVVX3deAx9LdjK8jCk

* test(pm): pin the env-carried carrier in dispatch-gates' self-test (1478 -> 1496)

Fixture pins for the specimen shape, the literal-`env:` negative, the
argv-carried regression control, the one-value-one-carrier filter that keeps
#15441's repaired `--base` families runnable, and the four limbs of
`workflowEnvValues`. Plus the live pin on the specimen workflow's own change
set: the bare invocation leaves `--commands` and is named NOT MEASURED, while
the `pnpm check:` form stays.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012zGPuVVX3deAx9LdjK8jCk

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: claude[bot]