template is documented pure and reads the host environment #680

Epic: #454
Plan: docs/plans/template-purity-claim.md

3.5-provider-catalog.md describes the template provider as "pure" with "no filesystem."
pkg/op/provider/template/provider.go:110 maps "Env": os.Getenv into the template function map, so any template
string can read any environment variable on the rendering machine.

The behaviour is deliberate and documented at provider.go:105 — graphs are transportable, so resolving
environment values at plan time would embed them in persisted graph documents, potentially leaking secrets into
durable artifacts. The claim of purity is what is wrong.

This is also the counterexample that bounds per-method classification: template.render_text has the signature of
a pure function and the behaviour of a query, decided by a string passed at runtime. No static classification can
decide it. That limit belongs in 3.6 §3, not in a catalog footnote.

Whether Env survives is deferred to 3.6, where it is already an open question — removing it breaks any
authored template that uses it, and the per-runtime alternative needs the module-selection plumbing tracked by
#563.