Protected-prefixes env merge overview

Merge policy used when settings layers ship sensitive env keys that plugins SHOULD NOT be able to overwrite. Any persistEnv / contextVars key whose name starts with one of `protectedPrefixes` is locked in by the first handler that sets it; later handlers attempting to override such a key produce a HookMergeDiagnostic with outcome=conflict and severity=warning.