[thebrandonlucas]

Fixes DEV-2956
Closes #121

Problem

With --profile, or with a flag such as --wallet, the CLI ignores a set VOLTAGE_ORGANIZATION_ID, VOLTAGE_ENVIRONMENT_ID, VOLTAGE_WALLET_ID, VOLTAGE_API_KEY, or VOLTAGE_CONFIG_DIR. Only voltage context said so, in ignored_variables. The voltage-api skill's helper reads the same names and lets them win, so in one shell the helper and the CLI could act on different wallets without any sign.

Behavior

Every command that reads the configuration prints one stderr line per ignored variable, before it prompts or sends a request:

$ VOLTAGE_ENVIRONMENT_ID=ENV_A VOLTAGE_WALLET_ID=WALLET_A voltage wallets list --profile staging
warning: VOLTAGE_ENVIRONMENT_ID is set but ignored because --profile staging is selected
warning: VOLTAGE_WALLET_ID is set but ignored because --profile staging is selected
$ VOLTAGE_WALLET_ID=WALLET_A voltage wallets get --wallet WALLET_B
warning: VOLTAGE_WALLET_ID is set but ignored because --wallet is given

Variable	Ignored when	Warning says
VOLTAGE_ORGANIZATION_ID, VOLTAGE_ENVIRONMENT_ID, VOLTAGE_WALLET_ID	--profile is selected, or --org / --env / --wallet is given	--profile NAME is selected, or --org is given (and so on)
VOLTAGE_API_KEY	--profile or --account	--profile NAME is selected or --account is given
VOLTAGE_CONFIG_DIR	--config-dir	--config-dir is given

• stdout and --json results are unchanged. The warning is a stderr line, warning: in the caution color on a terminal, plain when redirected.
• --quiet keeps it. --quiet hides optional progress and notices; docs/guides/scripting.md says it never hides warnings, and the offset-pagination deprecation already follows that. A silent override is what this issue is about, so hiding it behind --quiet would bring the problem back for scripts.
• A variable that is actually used gets no warning.
• price, convert, completions, and bare voltage read no scope, so they never warn.

Design notes

• config::ignored_variables now returns IgnoredVariable { name, precedence }, where Precedence is Flag("--wallet") or Profile, decided from the same ScopeSources as before. auth::ignored_api_key replaces ignores_ambient_api_key the same way.
• context::ignored_variables joins the two lists. voltage context maps it to names (its JSON is unchanged), and Session::open passes it to context::warn_ignored right after the scope is resolved. One list feeds both, so the warning and voltage context cannot disagree.
• The profile name in the warning goes through Line::text, which scrubs control characters.
• Not done: the issue also suggested adding the list to error.detail of --json errors. That changes the error contract, so it is left for a follow-up if wanted.

Try it on staging

The wrapper drops VOLTAGE_* variables exported in your shell and passes only the ones in .env. These steps need VOLTAGE_ORGANIZATION_ID and VOLTAGE_ENVIRONMENT_ID set in .env (add them if they are not there; any valid UUIDs show the warning).

alias voltage="$PWD/scripts/voltage-staging"
voltage --build
voltage login --account me --credential-store file

voltage context --account me

Expect: no warning. organization_id and environment_ids show source environment.

voltage wallets list --account me --org ORG_ID

Expect, before the wallet table: warning: VOLTAGE_ORGANIZATION_ID is set but ignored because --org is given. Use your real organization ID so the list succeeds.

voltage profiles create try-it --account me --org ORG_ID --env ENV_ID
voltage wallets list --profile try-it --quiet
voltage wallets list --profile try-it --json | head -c 80
voltage profiles delete try-it

Expect: both lists start with one warning: … is set but ignored because --profile try-it is selected line for each VOLTAGE_* variable in .env, --quiet included. With --json, stdout is still the JSON envelope (the warnings are on stderr). The delete removes the profile.

Validation

• cargo fmt --check, cargo clippy --locked --all-targets -- -D warnings, cargo machete --with-metadata, cargo test --locked (200 unit, 150 integration), and python3 scripts/check-coverage.py all pass.
• New unit tests in context: the warning text for a profile, a flag, and --account; the sentence without a profile name; and that a profile name with escape characters is scrubbed (checked on the unstripped line).
• Integration: profile_credentials_override_ambient_key_and_scope now checks the exact stderr under --profile --quiet (organization, environment, and API key, in that order) and that stdout is still the JSON result. New a_flag_over_a_set_variable_warns_and_a_used_variable_does_not checks --org over a set variable, and no warning when the variable is used.
• CRAP (scripts/crap-report.sh, cargo-llvm-cov 0.8.5, knots 1.16.0): 848 of 1059 functions measured, 0 violations. The highest score is 18.10, wait_for_payment in src/api.rs, which this PR does not change. Changed functions: context::inspect 12.01, Session::open 5.0, ignored_api_key 4.0, config::ignored_variables 3.0, ignored_warning and warn_ignored 2.0.

Checklist

• User-visible change: a guide or reference under docs/ and CHANGELOG.md (Unreleased) are updated. (docs/guides/login-and-profiles.md, docs/reference/environment.md)
• The verification gate in docs/development.md passes.
• The diff was reviewed against its base with the voltage-pr-review skill, and every new error and early-return path has a test.
• CRAP report: highest 18.10 (wait_for_payment, unchanged); no function at or above 20.
• Checks not run, and why: the staging steps above were not run by the author. The warning is not tested on a real terminal (color) by an automated test; the color comes from the existing important_line path.