ci+fix: run snapshot tests in CI and load .env only when recording

Holistic-review fixes for integration gaps the per-commit reviews missed:

- CI now runs `pnpm run test:snapshot` (a step after the coverage gate). It was
  wired into pre-push but not .github/workflows/ci.yml, so the RFC/AGENTS claim
  that snapshot replay runs in the default PR gate was only half-true — CI is
  the real gate.
- vitest.snapshot.config.ts loads the repo .env ONLY when DSH_SNAPSHOT=record.
  Loading it unconditionally contradicted the replay safety story (replay must
  never reach the network), and runScenario forwards process.env to the child.
  Non-ENOENT load errors now surface instead of being swallowed.
- start.ts: the graceful-shutdown comment said "RECORD runs" but the path
  applies to both snapshot modes (replay also closes stdin → dispose → exit).
- docs/development.md: list the new pre-push snapshot job and the CI snapshot
  gate.

.github/workflows/ci.yml

@@ -60,6 +60,15 @@ jobs:
       - name: Tests with coverage gate (per-file 100%)
         run: pnpm run test:coverage
 
+      # ACP snapshot tests (acp-snapshot-tests RFC): boot the real acp-agent
+      # subprocess and replay recorded session-log fixtures, diffing the
+      # normalized stdout transcript + re-persisted log against committed
+      # goldens. KEYLESS by design — the same `test:snapshot` script the pre-push
+      # hook runs (one source of truth), so the full-transcript regression net
+      # is part of every PR gate, not just local pre-push.
+      - name: Snapshot tests (ACP transcript replay)
+        run: pnpm run test:snapshot
+
       # Before hygiene: publint validates the packed artifacts (lib/index.js),
       # which only the tsdown bundling step emits.
       - name: Build (tsc -b + tsdown bundles)