feat(portal): allow probe headers, literal or from the environment

[cooper (czxtm)]

Replaces the Cloudflare Access support that was briefly on main and has been
force-pushed out. prelude is a general-purpose devshell/MOTD library — it has no
business knowing what Cloudflare is, and it certainly should not scan a shell
for credentials.

Two options on an environment instead:

prod = {
  url = "https://app.example.dev";
  gated = true;
  headers        = { "X-Api-Version" = "2026-01-01"; };
  headersFromEnv = { "Authorization" = "MY_PROBE_TOKEN"; };
};

The portal forwards exactly what the project declared, only to the environment
that declared it. It knows nothing about any auth provider.

Why two options rather than one

The catalogue is generated into the Nix store from a file in a git repo, so a
value in headers is a value in the repo. Secrets belong in headersFromEnv,
which carries the variable name and is read at probe time.

An unset variable is skipped, not sent empty — an unconfigured shell probes
anonymously rather than sending a malformed request that looks like a broken
credential.

Verified

Against a real gated host, with the same catalogue, differing only in whether
the environment supplied the variables:

no env set     gated  chat  prod  sign-in required · 118ms
env supplied   up     chat  prod  200 · 288ms

Tests cover the literal header, the env-sourced header, that an unset variable
produces no header, and that headers do not carry over between environments
sharing a prober.

🤖 Generated with Claude Code

[cooper (czxtm)]

Merging with the airline check red. It is pre-existing (main has had 2 green Test runs in its last 30) and unrelated: the failure is prompt-shadow-palette, whose PTY smoke never sees the airline bar because ble.sh sits at updating tput cache for the whole window. I reproduced that locally on a clean build with a 90s deadline, so it is not a timeout — the bar genuinely never renders in the sandbox. That is prompt/ble.sh territory, not this PR's.

Two things this PR does fix that were masking it: nix/preflight-hook-pty-test.py and nix/prompt-final-pty-test.py were referenced by checks.nix but missing from the tree, so every check behind them was blocked and never ran.