fix(config): escape env substitutions

[dannyward630]

Summary

• escape {env:...} substitution values before inserting them into config text
• add regression coverage for Windows-style path env values used as permission keys

Closes #32695

Verification

• bun test test/config/config.test.ts --timeout 30000 --filter "environment variable" from packages/opencode
• bun run typecheck from packages/opencode
• full pre-push bun turbo typecheck

[github-actions]

This PR doesn't fully meet our contributing guidelines and PR template.

What needs to be fixed:

• PR description is missing required template sections. Please use the PR template.

Please edit this PR description to address the above within 2 hours, or it will be automatically closed.

If you believe this was flagged incorrectly, please let a maintainer know.

[github-actions]

The following comment was made by an LLM, it may be inaccurate:

Found a potential duplicate:

PR #32786 - fix(opencode): escape {env:} substitutions to keep config JSON valid

• fix(opencode): escape {env:} substitutions to keep config JSON valid #32786

This appears to be addressing the same issue: escaping environment variable substitutions in config to maintain valid JSON. This may be a related or duplicate PR that should be reviewed to ensure both aren't tackling the identical problem.

[github-actions]

This pull request has been automatically closed because it was not updated to meet our contributing guidelines within the 2-hour window.

Feel free to open a new pull request that follows our guidelines.