fix(o11y): use local dev bindings

[RSO]

Summary

• Force the o11y Worker dev/start scripts into local Wrangler mode so dev startup does not trigger Cloudflare OAuth.
• Add o11y env-sync templates for the Worker and web app so pnpm dev:env wires local o11y URLs and the shared admin token.
• Fix env-sync replacement/formatting so values with replacement tokens or escaped newlines are written literally and stay stable across checks.

Verification

• Started the o11y Worker dev server locally and confirmed all bindings were reported in local mode without an OAuth login attempt.
• Ran pnpm dev:env cloudflare-o11y nextjs -y, then confirmed the generated env files were stable with pnpm dev:env cloudflare-o11y nextjs --check except for expected missing local Secrets Store warnings for alert-only secrets.

Visual Changes

N/A

Reviewer Notes

• pnpm dev:env cloudflare-o11y nextjs --check still warns when local Secrets Store entries for the Analytics Engine token and Slack webhooks are absent; those are not generated from .env.local and are only needed for local alert querying/Slack notification paths.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (4 files)

• apps/web/.env.development.local.example
• dev/local/env-sync/output.ts
• services/o11y/.dev.vars.example
• services/o11y/package.json

---

_{Reviewed by gpt-5.4-20260305 · 693,177 tokens}