checks/environment: refuse a module reading a MESH_* word nothing sets

A word its manifest does not set and the mesh gives no process is a contract nobody
keeps (MESH_REGISTRY_REACH, MESH_CONFIG_CALLERS). The 63 reads outside this milestone's
modules are listed in unset, which only shrinks (lead's ruling on A3n).

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig

.gitignore

@@ -34,6 +34,7 @@ modules/mesh-build-image/cmd/mesh-build-image/mesh-build-image
 
 # binaries a local go build leaves in a module root
 /checks/paths/paths
+/checks/environment/environment
 /modules/mesh-build-go/mesh-build-go
 /modules/mesh-delivery-gate/mesh-delivery-gate
 modules/mesh-config/cmd/mesh-config/mesh-config