fix(cli): make the per-env approval gate fail closed

Review #2 (MEDIUM). The M3 `[project.environments]` approval gate silently
failed open in three shapes:

- `EnvPolicy.confirm` was `#[serde(default)]`, so `production = {}` parsed as
  un-gated. `confirm` is now a REQUIRED field — an env listed with an empty
  policy is a load error (`missing field 'confirm'`), not a silent no-gate.
- `pic apply --file <leaf>` where the leaf carried no `[project]` skipped the
  gate even when the repo root gated the env. `run` now discovers the governing
  `[project]` by walking up from the manifest to the nearest ancestor
  `picloud.toml` that declares one (`find_governing_project`, loaded without the
  env overlay — only the block matters).
- A `[project].environments` in a non-root manifest under `--dir` was dropped
  with a generic "ignored" note; `build_tree` now warns explicitly that its
  approval gating is not enforced.

Pinned by `tests/env_approval.rs` (empty-policy load error; leaf `--file` apply
honoring the root gate).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/tests/env_approval.rs

@@ -90,3 +90,117 @@ fn confirm_required_env_needs_explicit_approve() {
         "an un-gated env must apply without --approve"
     );
 }
+
+#[ignore = "needs DATABASE_URL pointing at a running Postgres"]
+#[test]
+fn an_env_listed_with_an_empty_policy_is_a_hard_error() {
+    // `production = {}` (no `confirm`) must FAIL to load, not silently parse as
+    // un-gated — you can't half-declare a gate. `confirm` is a required field.
+    let Some(fx) = common::fixture_or_skip() else {
+        return;
+    };
+    let env = common::admin_env(fx);
+    let group = common::unique_slug("eae-grp");
+    let project = common::unique_slug("eae-proj");
+    let _g = GroupGuard::new(&env.url, &env.token, &group);
+
+    let dir = TempDir::new().unwrap();
+    let manifest = dir.path().join("picloud.toml");
+    fs::write(
+        &manifest,
+        format!(
+            "[project]\nslug = \"{project}\"\n\n\
+             [project.environments]\nproduction = {{}}\n\n\
+             [group]\nslug = \"{group}\"\nname = \"Empty Policy\"\n"
+        ),
+    )
+    .unwrap();
+    fs::write(dir.path().join("picloud.production.toml"), "# overlay\n").unwrap();
+
+    let out = common::pic_as(&env)
+        .args(["apply", "--file"])
+        .arg(&manifest)
+        .args(["--env", "production"])
+        .output()
+        .expect("apply");
+    assert!(
+        !out.status.success(),
+        "an env with an empty policy must be a load error, not a silent no-gate"
+    );
+    let err = String::from_utf8_lossy(&out.stderr).to_lowercase();
+    assert!(
+        err.contains("confirm"),
+        "the error must name the missing `confirm` field:\n{err}"
+    );
+}
+
+#[ignore = "needs DATABASE_URL pointing at a running Postgres"]
+#[test]
+fn leaf_file_apply_honors_the_root_env_gate() {
+    // `pic apply --file <leaf>` where the leaf carries no `[project]` still
+    // honors the gate declared in the repo root (found by walking up).
+    let Some(fx) = common::fixture_or_skip() else {
+        return;
+    };
+    let env = common::admin_env(fx);
+    let base = common::unique_slug("eal-base");
+    let leaf = common::unique_slug("eal-leaf");
+    let project = common::unique_slug("eal-proj");
+    let _b = GroupGuard::new(&env.url, &env.token, &base);
+    let _l = GroupGuard::new(&env.url, &env.token, &leaf);
+    common::pic_as(&env)
+        .args(["groups", "create", &base])
+        .assert()
+        .success();
+    common::pic_as(&env)
+        .args(["groups", "create", &leaf, "--parent", &base])
+        .assert()
+        .success();
+
+    // Root manifest carries the gating `[project]`; the leaf (in a subdir) has
+    // no `[project]` of its own and is applied on its own with `--file`.
+    let dir = TempDir::new().unwrap();
+    fs::write(
+        dir.path().join("picloud.toml"),
+        format!(
+            "[project]\nslug = \"{project}\"\n\n\
+             [project.environments]\nproduction = {{ confirm = true }}\n\n\
+             [group]\nslug = \"{base}\"\nname = \"Base\"\n"
+        ),
+    )
+    .unwrap();
+    let sub = dir.path().join("sub");
+    fs::create_dir_all(&sub).unwrap();
+    let leaf_manifest = sub.join("picloud.toml");
+    fs::write(
+        &leaf_manifest,
+        format!("[group]\nslug = \"{leaf}\"\nname = \"Leaf\"\n"),
+    )
+    .unwrap();
+    fs::write(sub.join("picloud.production.toml"), "# overlay\n").unwrap();
+
+    // Without --approve: refused, because the gate is discovered up-tree.
+    let out = common::pic_as(&env)
+        .args(["apply", "--file"])
+        .arg(&leaf_manifest)
+        .args(["--env", "production"])
+        .output()
+        .expect("apply");
+    assert!(
+        !out.status.success(),
+        "a leaf --file apply must honor the root's env gate"
+    );
+    let err = String::from_utf8_lossy(&out.stderr).to_lowercase();
+    assert!(
+        err.contains("approve") && err.contains("production"),
+        "the refusal must point at --approve production:\n{err}"
+    );
+
+    // With --approve production: passes the gate and applies (leaf pre-exists).
+    common::pic_as(&env)
+        .args(["apply", "--file"])
+        .arg(&leaf_manifest)
+        .args(["--env", "production", "--approve", "production"])
+        .assert()
+        .success();
+}