feat(controller): expose spec.env through REST API

[shenjiecode]

Summary

Follow up on the REST/CLI work intentionally deferred by #690.

WorkerSpec.Env and ManagerSpec.Env already exist in the CRD and are merged into container environments, but the public REST create/update DTOs do not carry them. As a result, agt apply -f accepts manifests containing spec.env and forwards the field to the REST API, where it is currently ignored.

This PR:

• carries env through Worker and Manager REST create/update requests;
• preserves omitted env on partial updates, replaces the complete user map when supplied, and supports explicit clearing with env: {};
• keeps env values out of Worker/Manager REST responses;
• adds handler coverage for create, replace, empty-string values, and clear semantics;
• adds an agt apply -f YAML projection regression;
• documents the field and secret-storage caveat in English and Chinese.

The existing system-wins collision policy and controller-to-backend propagation are unchanged.

Verification

• go test ./internal/... ./cmd/...
• make test-integration

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[shenjiecode]

Hi @shiyiyue1102 👋

Quick context: this follows up on the REST/CLI surface that #690 intentionally deferred — it carries spec.env through the Worker/Manager REST create/update DTOs, so agt apply -f no longer silently drops user env (raw kubectl apply already worked via #690). The existing merge semantics (system-wins, controller→backend propagation) are unchanged.

Since this is my first contribution to the repo, branch protection is holding a couple of things up. Could you help with:

1. Workflow approval — a couple of workflows show "awaiting approval" (the first-time-contributor gate), so CI hasn't actually run yet.
2. Review — happy to address any feedback.

The branch has no conflicts with main (cleanly mergeable), and I can re-sync it right before merge. Thanks for taking a look!