sync: bring verify-edit in line + scan adapter package sources

Two follow-ups to the server/src env-var scan widening:

1. verify-edit.mjs had its own copy of shouldFetchEnvSource with the same
   narrow server allowlist — apply the identical server/src/**/*.ts widening
   so the verify phase stops emitting unverified env-var false positives.

2. Both scripts now also scan all non-test packages/adapters/<name>/src/**/*.ts.
   Adapter packages read env vars directly in their server/index modules —
   e.g. SANDBOX_INSTALL_COMMAND (packages/adapters/{pi,claude,gemini,cursor}-local/src/...)
   and per-runtime API-key fallbacks — which the old allowlist never fetched.

Verified against parent v2026.618.0:
- check-drift: 0 drift (65 env vars checked).
- verify-edit docs/reference/adapters/sandbox-providers.md: 6/6 claims verified
  (SANDBOX_INSTALL_COMMAND, previously unverified, now resolves).
- sync:test 33/33.

Selection grows to ~452 files, still well under the 700 cap.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

scripts/sync/check-drift.mjs

@@ -398,6 +398,10 @@ function shouldFetchEnvSource(path) {
   if (/^cli\/src\/checks\/.+(?:auth|config|secret|env).+\.ts$/.test(path)) return true;
   if (/^cli\/src\/commands\/(?:env|env-lab|configure|client\/secrets|client\/auth)\.ts$/.test(path)) return true;
   if (path.startsWith("packages/plugins/sandbox-providers/") && /(^|\/)(README\.md|manifest\.ts|config\.ts|plugin\.ts|worker\.ts)$/.test(path)) return true;
+  // Adapter packages read env vars (e.g. SANDBOX_INSTALL_COMMAND, per-runtime
+  // API-key fallbacks) directly in their server/index modules — scan all
+  // non-test adapter package source, same reasoning as server/src above.
+  if (/^packages\/adapters\/[^/]+\/src\/.+\.ts$/.test(path)) return true;
   if (/^packages\/adapter-utils\/src\/(?:.*env.*|execution-target.*|sandbox.*|remote.*|workspace.*)\.ts$/.test(path)) return true;
   if (/^packages\/shared\/src\/.*(?:config|environment|secret|workspace|runtime).*\.ts$/.test(path)) return true;
   if (/^packages\/[^/]+\/src\/(?:env|config|runtime-config|worktree-config)\.ts$/.test(path)) return true;

scripts/sync/verify-edit.mjs

@@ -811,13 +811,20 @@ function shouldFetchEnvSource(path) {
   if (!/\.(?:ts|tsx|js|mjs|json|md)$/.test(path)) return false;
   if (!/^(cli\/src|server\/src|packages|ui\/src)\//.test(path)) return false;
   const base = path.split("/").pop();
-  if (path === "server/src/config.ts" || path === "server/src/config-file.ts") return true;
-  if (/^server\/src\/(auth\/better-auth|agent-auth-jwt|runtime-api|worktree-config)\.ts$/.test(path)) return true;
-  if (/^server\/src\/services\/(?:environment|execution-workspace|workspace|secret|plugin|sandbox)[A-Za-z0-9_-]*\.ts$/.test(path)) return true;
+  // Scan every non-test server/src TypeScript file. Server feature files read
+  // process.env directly all over the place (e.g. TRUST_PROXY in app.ts, the
+  // OTEL_* vars in instrumentation.ts, request middleware under middleware/),
+  // so any narrower server allowlist leaves blind spots that surface as
+  // unverified env-var claims. Tests are already excluded above.
+  if (/^server\/src\/.+\.ts$/.test(path)) return true;
   if (/^cli\/src\/config\/.+\.ts$/.test(path)) return true;
   if (/^cli\/src\/checks\/.+(?:auth|config|secret|env).+\.ts$/.test(path)) return true;
   if (/^cli\/src\/commands\/(?:env|env-lab|configure|client\/secrets|client\/auth)\.ts$/.test(path)) return true;
   if (path.startsWith("packages/plugins/sandbox-providers/") && /(^|\/)(README\.md|manifest\.ts|config\.ts|plugin\.ts|worker\.ts)$/.test(path)) return true;
+  // Adapter packages read env vars (e.g. SANDBOX_INSTALL_COMMAND, per-runtime
+  // API-key fallbacks) directly in their server/index modules — scan all
+  // non-test adapter package source, same reasoning as server/src above.
+  if (/^packages\/adapters\/[^/]+\/src\/.+\.ts$/.test(path)) return true;
   if (/^packages\/adapter-utils\/src\/(?:.*env.*|execution-target.*|sandbox.*|remote.*|workspace.*)\.ts$/.test(path)) return true;
   if (/^packages\/shared\/src\/.*(?:config|environment|secret|workspace|runtime).*\.ts$/.test(path)) return true;
   if (/^packages\/[^/]+\/src\/(?:env|config|runtime-config|worktree-config)\.ts$/.test(path)) return true;