fix(env-preload): later layer can override earlier (was: first wins)

The old guard `if (process.env[key] !== undefined) continue` skipped any
key that already existed in process.env at the time of the check. After
~/.jitsu/.env.local loaded, every shared key was in process.env, so the
repo-level <repo>/.env.local could never override it — backwards from
the documented "later wins" precedence.

Snapshot the shell's original env keys at startup; only those are
untouchable. Keys set by a previous file load are overwritable, so the
order is now:

  shell  >  <repo>/.env.local  >  ~/.jitsu/.env.local

Verified end-to-end: repo overrides home for shared keys; home-only
keys still load; shell still wins over both.

Author: vklimontovich

env-preload/preload-env.cjs

@@ -15,6 +15,11 @@
 const fs = require("node:fs");
 const path = require("node:path");
 
+// Snapshot keys the shell already set BEFORE we touch anything. Used by
+// loadEnvFile to decide what's untouchable (shell wins) vs what a later
+// file is allowed to override (an earlier file's value).
+const shellEnvKeys = new Set(Object.keys(process.env));
+
 function findRepoRoot(start) {
   let dir = path.resolve(start);
   while (true) {
@@ -39,7 +44,10 @@ function loadEnvFile(filePath) {
     const m = /^([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(line);
     if (!m) continue;
     const key = m[1];
-    if (process.env[key] !== undefined) continue;
+    // Only the shell's original env is untouchable. A key set by an earlier
+    // file (e.g. ~/.jitsu/.env.local) gets overwritten here, which is the
+    // documented "later wins" precedence.
+    if (shellEnvKeys.has(key)) continue;
     let value = m[2];
     if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
       value = value.slice(1, -1);