refactor(cli): cover gen signing-key and gen keys with effect lint (CLI-2410)

[7ttp]

TL;DR

brings supabase gen signing-key and supabase gen keys under the effect lint

whats introduced?

effect lint applied to signing-key and keys

• three allow list entries in .oxlintrc.effect.json, gen/*.ts, gen/keys/** and gen/signing-key/**
• the handler yields its tagged errors directly instead of wrapping them in Effect.fail, and the shared signing keys config runs its alg allowlist check inside Effect.try
• the stored key file encodes through Schema.fromJsonString, byte for byte what it wrote before, two space indented for the file and compact for the JWK on stdout
• SUPABASE_ENV reads through Config rather than process.env, so an unset and an empty value both keep the development default
• e2e tests run through the effect native harness and own their project directory with makeTempDirectoryScoped, so an interrupted run cleans up after itself
• integration tests keep all twenty eight scenarios and add five that pin the stdout and file bytes and the injected SUPABASE_ENV dotenv pick, fixtures go through FileSystem and cause assertions use Cause.pretty

ref:

• related: CLI-2410

[github-actions]

🤖 AI Review

The refactor has two confirmed low-severity concerns. An injected ConfigProvider can make the dotenv loading phases disagree about SUPABASE_ENV; the live provider reads process.env, so this does not affect the normal CLI runtime. The signing-key wiring test no longer uses the production gen parent, although the E2E tests still exercise the production command route.

Findings

Severity	Location	Category	Sources	Claim
🟡 MINOR	apps/cli/src/commands/gen/gen.signing-keys-config.ts:334	correctness	codex	An injected ConfigProvider can make the new skipEnvLocal decision disagree with the later process.env-based dotenv resolution.
⚪ NIT	apps/cli/src/commands/gen/signing-key/signing-key.integration.test.ts:147	test-coverage	claude	The command-wiring integration test constructs its own gen parent, so that test no longer exercises the production gen command tree.

Stats

Claude findings: 1 · Codex findings: 1 · Confirmed: 2 · Refuted: 0 · Uncertain: 0

---

Models: claude-opus-5-5 + gpt-6-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.

[Coly010]

Nice work on this one, and thanks for picking up the ConfigProvider point from the bot so quickly. I diffed the old JSON.stringify output against the new Schema encoding on real RSA/EC/Ed25519 keys plus a pile of weird inputs (undefined, NaN, U+2028, numeric keys) and it's byte-identical, trailing newline included. SUPABASE_ENV behaves the same for every value I tried as well

Approving, with one ask inline around test coverage for the env fix, and a smaller one on the same JSON.parse wrapper pattern as #6764