feat(plugin-devenv): capture a devenv environment and run targets in it

[raphaelvigee]

Phase 1c of #404, on top of #411. The half you actually asked for: a target runs inside the devenv.sh environment and inherits its tools.

target(name = "env", driver = "devenv")
target(name = "build", driver = "bash", run = ["cargo build"], runner = "//:env")

Proved end to end

Against this repo's own devenv, three assertions in both directions:

target under the runner finds cargo	PASS
same target without it does not	PASS
every PATH entry it sees is /nix/store	PASS

A correction to the evidence behind the store-only rule

The original measurement came from the live interactive shell's $PATH — 107 entries, 38 outside /nix/store. Right worry, wrong source. print-dev-env reports the derivation's environment: on the same machine, 66 PATH entries, all store paths. The login PATH the shell appends simply isn't in it.

The store-only rule stays anyway, because it's a guarantee, not a repair: nothing about print-dev-env promises it, and what it prevents is silent — a mutable host directory in the snapshot means two machines with identical PATH strings and different tools produce identical cache keys.

Filtering: three rules, not an allowlist

print-dev-env reports 181 variables. An allowlist of that surface is a permanent maintenance tax that fails closed — a missing entry silently removes a tool. Instead: exported only; names dropped for DEVENV_*/NIX_BUILD_*/__* and the per-invocation set; values dropped for naming the tree root, $HOME or $TMPDIR.

Against the real output that keeps 99 variables and drops exactly one on the value rule — shellHook, which embeds the checkout path. Frozen by a test asserting two different checkout paths give byte-identical snapshots, which is what keeps a laptop and CI on the same cache key.

Snapshots are local-cache only: the PATH is host-local /nix/store paths, and plugin-nix already refuses to share the same kind of artifact for the same reason.

Fixes a rule that was specified and never implemented

A session's PATH is supposed to replace the driver's rather than sit under it. It didn't — the driver's default was still winning, so the runner's PATH never took effect. The very first end-to-end run failed on exactly this.

It matters because with the driver's default appended, a tool missing from the environment falls through to the host — the ambient dependency a runner exists to remove — under a cache key asserting the runner's environment. An explicitly written path under a runner is now a hard error rather than a silent discard. Regression-tested end to end.

Snapshot mode's limitation is now recoverable

The snapshot records the environment's shell-function names, so a target calling one gets:

fmt-all is a shell function, not a binary on PATH — set mode = "session"

instead of "not found in PATH", which sends the reader hunting for a package that isn't missing. (Session mode itself lands in #414.)

Diagnostics

• heph inspect def gains a runner block: which runner, and how it was selected (target vs defaultRunner).
• heph inspect runners lists what the workspace can use.

Both static by design — every invocation owns its own session pool, so a separate process cannot see live sessions and would render an empty table that reads as "nothing is running".

Tests

7 unit (snapshot filtering, incl. the two-checkouts property and the real JSON shape) + 1 new e2e for the PATH-replacement rule, on top of the 10 already in exec_runner.rs. Full local run green: 545 e2e, plus engine/exec-runner/plugin-exec/heph. lint clean.

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}