#991 CRITICAL: {{ENV.<name>}} in workflow templates returns any worker environment variable (DB_PASSWORD, JWT secret, encryption keys, Vault admin token)

EARS SPEC: - The variable resolver shall not resolve any reference to the worker process environment. - If a workflow definition contains an {{ENV.<name>}} reference, then the engine shall reject it at submit with HTTP 400 WORKFLOW_VALIDATION_ERROR, and at execution time (JSON that bypasses the API) the task shall fail permanently with an error that names the reference but never a value. EVIDENCE (live, public API, tenant test, 2026-10-20 ~01:10Z): run 96463df3-ca96-4149-925c-e71966d831ee, task tools.shell.run 'echo HOST=[{{ENV.HOSTNAME}}]'; GET /api/v1/workflows/<run>/steps/logs returned HOST=[07d44efa4898] = hostname of highway-worker-2. Worker env (env_file docker/.env plus compose env) carries DB_PASSWORD, HIGHWAY_ENCRYPTION_KEY, RBAC_MASTER_ENCRYPTION_KEY, JWT secret, VAULT_TOKEN_ADMIN; any authenticated tenant user who can submit a workflow can read them. Probe used HOSTNAME only, no secret was resolved. CAUSE: engine/interpreters/variable_resolver/resolver.py resolve_variable_path ENV branch (os.environ.get); the same code is in variable_resolver_cy.pyx (not compiled in the image). Users: only tests/workflow_examples/agentic_llm_demo.py (OLLAMA_BASE_URL, Ollama retired) and both DSL_PROMPT copies. EXPOSURE: Highway has no users besides the owner (invite-only). Found by the #972 agent.