ci: pin go install tool versions (gitleaks/golangci-lint/staticcheck/gosec/govulncheck), env-docs check covers getEnv reads, ignore .sisyphus session artifacts

- ci.yaml: no more @latest — pinned to released versions; supply-chain audit clean (govulncheck gates CI, npm audit gate, lockfiles committed, npm ci)
- check-env-docs.py: detects env vars read via the getEnv() helper (R2_* blind spot closed); 42 vars documented
- .gitignore: .sisyphus/ review reports

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

scripts/check-env-docs.py

@@ -20,6 +20,12 @@ GETENV_RE = re.compile(
     r'os\.(?:Getenv|LookupEnv)\(\s*(?:"([A-Z_][A-Z0-9_]*)"|([A-Za-z_]\w*))\s*\)'
 )
 
+# Matches the codebase's custom getEnv(key, ...) helper (db/db.go,
+# db/db_dev.go, internal/s3/s3.go, internal/dav/service_dev.go,
+# internal/dav/service_prod.go, handlers/user/profile.go) — the first
+# argument is always a literal env var name.
+GETENV_HELPER_RE = re.compile(r'getEnv\(\s*"([A-Z_][A-Z0-9_]*)"')
+
 
 def go_const_map():
     """Return {package_name: {const_name: "ENV_NAME"}} from all backend Go files.
@@ -78,6 +84,7 @@ def find_env_vars_in_code():
                     env_vars.add(pkg_consts[identifier])
                 # Non-const identifiers (e.g. function params like getEnv(key))
                 # cannot be resolved to a specific env var — skip them.
+            env_vars.update(GETENV_HELPER_RE.findall(content))
 
     # Search frontend files for import.meta.env.VITE_* / import.meta.env.*
     frontend_dir = os.path.join(REPO_ROOT, 'frontend')
@@ -95,11 +102,23 @@ def find_env_vars_in_code():
     # itself and cannot be defined in .env.example — never treat them as user env vars.
     env_vars -= {'DEV', 'PROD', 'SSR', 'MODE', 'BASE_URL', 'BUILD'}
 
-    # GO_WANT_HELPER_PROCESS is the conventional Go test-internal sentinel for
-    # the "re-exec self as helper process" pattern (startup_checks_test.go sets
-    # it via cmd.Env on the re-exec'd binary). It is NOT a user-configurable
-    # variable — it never belongs in .env.example, so never flag it.
-    env_vars -= {'GO_WANT_HELPER_PROCESS'}
+    # Test-internal sentinels that are NOT user-configurable variables and so
+    # never belong in .env.example (never flag them):
+    #   - GO_WANT_HELPER_PROCESS: the conventional Go test-internal sentinel
+    #     for the "re-exec self as helper process" pattern
+    #     (startup_checks_test.go sets it via cmd.Env on the re-exec'd binary).
+    #   - TEST_DB_VAR / TEST_DB_MISSING_VAR: set by db_test.go's getEnv unit
+    #     tests (os.Setenv within the test itself), not read from any real
+    #     environment.
+    #   - SNAPSHOT_ENC_KEY_BRANCH / WEBHOOK_BRANCH / SQUARE_CRED_BRANCH:
+    #     re-exec sentinels for the fatal-branch startup tests
+    #     (startup_checks_test.go, square_http_client_test.go), set via cmd.Env
+    #     like GO_WANT_HELPER_PROCESS.
+    env_vars -= {
+        'GO_WANT_HELPER_PROCESS',
+        'TEST_DB_VAR', 'TEST_DB_MISSING_VAR',
+        'SNAPSHOT_ENC_KEY_BRANCH', 'WEBHOOK_BRANCH', 'SQUARE_CRED_BRANCH',
+    }
 
     return sorted(env_vars)