feat(variable): bulk-edit variables in $EDITOR with a reviewed diff

[futurepastori]

Adds railway variable edit: opens the service's variables in $EDITOR as a
dotenv document, diffs what you saved against what was there, prints an
IaC-style plan, and asks before writing anything. Saving and quitting is not
consent — :wq gets you a plan, not an apply.

railway variable edit
railway variable edit --demo     # offline fixture, no project or API needed

What the editor shows you

The first cut read its snapshot from variablesForServiceDeployment — the
rendered map a deploy receives. That map merges Railway-provided variables in
with the user's own and drops sealed values, which made for two bad outcomes:
RAILWAY_SERVICE_NAME and friends were offered as editable text, and a sealed
variable was invisible, indistinguishable from one that had been deleted.

It now reads the stored user variables through variables(unrendered: true)
and takes isSealed from the environment's variable connection.

• Railway-provided variables are written as comments and excluded from the
  diff. Reserved names are rejected on parse and again before apply, so a
  pasted RAILWAY_* line cannot reach variableCollectionUpsert — which would
  otherwise persist a shadow row that the deploy-time merge silently overrides.
• Sealed variables round-trip as <sealed>. Left alone they produce no diff
  entry at all and the stored ciphertext is untouched; replaced, they rotate.
  Typing <sealed> by hand on a variable that is not sealed is an error rather
  than a silent no-op.
• Values are redacted in the plan by default. --reveal prints them.

Guardrails

• The temp file is written 0600. It holds every plaintext value, and it was
  landing in a world-readable path.
• Deletions need --confirm-destructive when there is no one at the terminal to
  answer the prompt — --yes, a pipe, or an agent session. This matches how
  config apply treats destructive change.
• Edits that cannot be applied are rejected before the plan is printed, so you
  are never asked to confirm something that will then fail.
• A non-zero exit from the editor aborts without touching anything.

Flags

--yes, --skip-deploys, --reveal, --confirm-destructive, --demo, plus
the usual --service / --environment / --project.

Testing

cargo test — 1324 pass, 11 of them new around reserved-name exclusion, sealed
preserve/rotate, the hand-typed <sealed> rejection, dotenv round-tripping, and
temp file permissions. cargo fmt --check and cargo clippy --all-targets --all-features are clean for the touched files.

Not yet covered: variable references (${{...}}) round-trip as their raw
unrendered text, which is correct for storage but means the editor shows the
reference rather than its value.