feat(dev): DCNTRLIZED_DEV drives dev mode; dev fleet runs real mTLS

The single canonical dev flag is DCNTRLIZED_DEV=true, injected by every
docker-compose.debug/dev.yaml. Dev mode now selects endpoints and behaviors
without downgrading control-plane security:

- lib/env: IsDev()/GiteaURL(); registry BaseURL keys on DCNTRLIZED_DEV and
  DCNTRLIZED_GITEA_URL (renamed from GITEA_URL).
- authmgmt: Scheme()/PeerTransport() (satellite edges) key on DCNTRLIZED_DEV
  — dev satellites keep a plaintext RN-facing listener, production mTLS. The
  auth-management edge (New()) stays mTLS in both, preferring
  DCNTRLIZED_AUTH_URL in dev.
- Removed INSECURE_INTERNAL + propagateInsecureInternal from Maestro: the
  orchestrator no longer runs plaintext, and no longer injects the escape
  hatch into services it starts.
- lib/devboot: at boot (dev only) Maestro provisions the identities its
  compose-managed peers bind-mount at /dcntrlized/pki (before infra boots)
  and approves the known fleet in the auth trust store. Unknown peers still
  record a pending authorization and are refused (mechanisms active).
- Composes: prod docker-compose.yaml is clean (no DCNTRLIZED_DEV/GITEA_URL);
  the debug compose carries the dev flag + DCNTRLIZED_GITEA_URL only.

src/lib/env/env.go

@@ -0,0 +1,34 @@
+// Copyright (C) 2026 Dcntrlized
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published
+// by the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+// Package env centralizes environment-derived configuration. DCNTRLIZED_DEV is
+// the single canonical dev-mode flag, injected by every docker-compose.dev.yaml
+// and docker-compose.debug.yaml. It selects dev-only endpoints and behaviors
+// (registry URL, plaintext satellite peer edges) — it never downgrades the
+// transport security of the control-plane edges, which run mTLS in dev too.
+package env
+
+import "os"
+
+// IsDev reports whether Maestro runs in dev mode (DCNTRLIZED_DEV=true).
+func IsDev() bool {
+	return os.Getenv("DCNTRLIZED_DEV") == "true"
+}
+
+// GiteaURL returns the dev Gitea base URL (DCNTRLIZED_GITEA_URL). Empty in
+// production, where the hardcoded https://git.dcntrlized.org is used.
+func GiteaURL() string {
+	return os.Getenv("DCNTRLIZED_GITEA_URL")
+}