feat(remote): create or rotate an environment's engine key

[outofcoffee]

Set an environment's engine key from the CLI, and resolve it for fleet routing.

Summary

• outfit remote deploy --api-key-env VAR resolves the variable (process environment, then the .env beside the Outfit) and sends its value to the deploy, which creates the environment's key secret or rotates it. The reply carries only the action (created/rotated), never the value; a deploy with no flag leaves the stored key alone — generated only if absent, never regenerated.
• fleet.yaml gains apiKeyEnv, the fleet-wide default variable holding a kind: remote node's engine key (a node's own engineTokenEnv still wins). A launch that cannot resolve it fails before the agent starts, rather than pointing it at a gate it cannot pass.
• The key never lands anywhere it would persist: not in the deploy-config, the SSM parameter, the fleet file, or the logs.

Implementation details

• The key is a property of the deploy request, the shape allowedCidr/reseed already set: it rides in the SigV4 body beside them with omitempty, so a control plane that predates it sees exactly the body it always saw.
• The Lambda's ensureEnvApiKey is create-or-set — CreateSecret when the secret is absent, PutSecretValue when it exists (which invalidates the old key) — and distinguishes the two in its reply, since a first keyed deploy creates rather than rotates.
• The Go client resolves the variable only after the Outfit's local environment has been applied, so an exported value wins and the .env fills a gap — the same precedence outfit uses everywhere.
• The two surfaces stay independent: the deploy flag sets the secret, the fleet file names the variable that holds it. An operator who rotates a key via deploy must export the new value under the variable the fleet names; the fleet never guesses.