Batch 1.5: realign EnvConnector with synthing architecture

[mildronize]

Summary

Batch 1 shipped EnvConnector by copying kubricate's implementation mostly unchanged, but its own task-5 spec (uppercase transform) never matched the shipped code (exact-case matching), and it carried over kubricate mechanisms that don't fit synthing's design:

• SecretValue — shaped by kubricate's BaseProvider Kubernetes-Secret serialization constraint, which synthing has no equivalent of
• tryParseSecretValue() — connector-side JSON-sniffing that collides with the engine's coerceFromString(), since a connector never knows a key's declared type

A grilling session (recorded as decisions 94-99 in design-spec.md §14, plus the new _contract/base-connector-contract.md) worked through the realignment. This PR closes it out before Batch 2's resolution engine builds on top of the coercion boundary.

• BaseConnector: abstract class -> interface — structural typing avoids the dual-package hazard for connector plugins; config/logger/setWorkingDir?/getWorkingDir? join load/get as contract members
• EnvConnector: drop SecretValue + tryParseSecretValue, get() returns raw string only; caseInsensitive defaults to true; new maskValues config (default true) masks all logged values indiscriminately, since the connector has no visibility into which keys are secrets
• Also fixes 3 pre-existing scaffolding gaps uncovered along the way: toolkit/plugin-env/synthing were all missing eslint.config.mjs (lint had never actually run on them), and coerce.ts had an unused catch binding

Test plan

• pnpm build exits 0 (all packages)
• pnpm check-types exits 0 (all packages)
• pnpm test exits 0 (all packages, including 18 EnvConnector tests covering case-insensitivity, raw-value passthrough, and masked/unmasked logging)
• pnpm lint:check exits 0 for core, toolkit, plugin-env

🤖 Generated with Claude Code