feat: add {{os}} template func + vault $VAR parity

[xaaha]

Summary

• Add {{os "VAR"}} template function for direct OS env var access in YAML request files
• Fix $VAR resolution parity: vault store values now resolve $VAR from OS env, matching .env file behavior

Why

• Users can reference shell env vars (GITHUB_TOKEN, CI_BUILD_ID) without defining intermediaries in the store
• {{os "VAR"}} is lazy — only resolves what's referenced, no sensitive vars leaked
• Vault $VAR gap meant KEY=$OS_VAR worked in .env but not in encrypted store

Test plan

• {{os "VAR"}} resolves set OS env vars
• Unset vars return empty string (matches shell behavior)
• Case sensitive lookup
• Mix {{.KEY}} and {{os "KEY"}} in same template
• Multiple {{os}} calls in one string
• Vault $VAR resolves from OS
• Non-string vault values unchanged
• go test ./... -count=1 — all pass, zero regressions