refactor: read host settings from HostEnvironment in root src and remaining packages #3751

Part of #3747. Blocked by #3749.

Scope

• Root and remaining packages: root src/** (CLI entry points excluded), packages/remote, plugins, session-journal, ad-script, platform-web, provider-webdriver, provider-limrun and provider-testmu.
• Everything else: any other package that refactor(host-kit): capture HostEnvironment once at entry points #3749, refactor(platforms): read host settings from HostEnvironment in platform and capture packages #3750 or refactor(daemon): daemon runtime owns no process globals #3752 doesn't own.
• Defaults: every env = process.env default parameter in this scope.

Required behavior

• Bound environment. Reads come from the bound HostEnvironment or from the plugin host's env. Behavior doesn't change.
• Released public functions keep their process.env default through a boundary wrapper until 0.22: remove superseded plugin, client and environment APIs #3759.

Done when

• These sources contain no process.env or process.cwd() outside declared entry points.
• Gates are green.