feat(desktop): thread baked build env into global agent config UI

[wpfleger96]

Summary

Removes the standalone "Baked build defaults" settings section and unifies baked build env values into the global agent defaults card where they semantically belong.

The backend already treats baked env as the floor under global (resolve_effective_agent_env: baked → global → persona → per-agent). The two-section display was a presentation artifact — this aligns the UI with that precedence chain.

What changed

Display-only unification — storage, precedence, spawn behavior, and auto-respawn are all unchanged.

GlobalAgentConfigSettingsCard.tsx

• Derives bakedProvider, bakedModel, bakedEffort, and bakedGenericRows from the existing get_baked_build_env IPC call.
• Provider dropdown zero-value option: when a baked provider is set, shows e.g. Databricks v2 (AI Gateway) (inherited from build) instead of the generic prompt; selecting any explicit provider overrides it, clearing back restores the inherited label.
• Model dropdown: passes bakedModel as globalModel to AgentModelField → zero-value option reads Inherit global default (goose-claude-opus-4-8) when the baked model is present.
• Effort dropdown: passes bakedEffort as inheritedEffort to EffortSelectField → the inherit option reads Inherit (medium) when a baked effort is present.
• Remaining generic baked keys (DATABRICKS_HOST, DATABRICKS_MODEL, etc.) flow to EnvVarsEditor as inheritedRows.
• Deletes the old standalone "Baked build defaults" SettingsOptionGroup block entirely.

EnvVarsEditor.tsx

• Adds opt-in inheritedRows?: readonly InheritedEnvRow[] and inheritedRowsLabel? props (default: build).
• Renders read-only rows after file-satisfied rows: key + value (pre-masked by Rust for secrets) + Inherited from build tag.
• A local user row with the same key suppresses the inherited row and shows an Overrides build default <masked-value> hint.
• Correctness invariant: inherited rows never enter rows state, never reach buildRecord/onChange, and are never written to global-agent-config.json.
• All agent create/edit dialogs are untouched (opt-in prop, not passed to them).

bakedEnvHelpers.ts (new)

• Pure getBakedProviderInheritLabel helper extracted into a side-effect-free module so unit tests can import it without React, TanStack Query, or Tauri IPC.

agent_config.rs

• Added BUZZ_AGENT_THINKING_EFFORT to the is_safe_to_reveal allowlist. This key is a non-secret enum (none/minimal/low/medium/high/xhigh/max) — without this change, a build with a baked effort value would cross IPC as masked: true and render as Inherit (••••••) in EffortSelectField instead of the actual value.
• Regression test baked_env_thinking_effort_is_unmasked asserts value: "medium", masked: false.

EnvVarsEditor.test.mjs

• 8 new tests: inherited row visibility, local-wins suppression, no-serialize invariant, masked-secret override hint, structured-key exclusion (BUZZ_AGENT_PROVIDER/MODEL/THINKING_EFFORT routed to dropdowns and not generic rows), and getBakedProviderInheritLabel label resolution.

Acceptance criteria

1. Internal build with baked env set as:

   export BUZZ_BUILD_BUZZ_AGENT_PROVIDER="databricks_v2"
   export BUZZ_BUILD_AGENT_ENV=$'DATABRICKS_HOST=https://block-lakehouse-production.cloud.databricks.com/\nDATABRICKS_MODEL=goose-claude-opus-4-8'

   Note: BUZZ_BUILD_AGENT_ENV is newline-delimited (agent_env.rs and build.rs both parse with .lines()). A single space-separated line produces one glued key, not two.

   Expected: no "Baked build defaults" section; provider dropdown shows "Databricks v2 (AI Gateway) (inherited from build)"; DATABRICKS_HOST and DATABRICKS_MODEL appear as read-only rows tagged "Inherited from build".

2. Picking an explicit provider overrides; clearing restores the inherited label. Zero change to spawn/readiness/auto-respawn behavior.

3. OSS build: pixel-identical to today (empty baked map short-circuits all new code).

4. Gates: typecheck ✅ · build ✅ · unit suite 2470/2470 ✅ · biome ✅ · cargo test (agent_config) 15/15 ✅