Warn when VARLOCK_ENV only guessed preview #1164

Follow-up from #1142.

Problem

When a platform is detected but reports neither a deployment environment nor a branch, VARLOCK_ENV falls back to preview. That is a reasonable best guess, but it is silent. Fly.io, Google Cloud Run, Heroku, Deno Deploy and Firebase App Hosting all land here, so a production app on those hosts resolves to preview unless the user sets the environment explicitly. Generic CI=true with no detected platform does too.

Proposal

Keep the preview fallback, and warn when it is actually relied on:

• Only when the value came from the bare fallback (not test detection, a platform-reported environment, or branch inference).
• Only when something reads it: @currentEnv=$VARLOCK_ENV, or an item/decorator whose active value references $VARLOCK_ENV.
• Not when the user overrides VARLOCK_ENV, or overrides their own flag derived from it (e.g. APP_ENV=$VARLOCK_ENV with APP_ENV=production set on the platform).

The warning names the platform and gives the fix: set VARLOCK_ENV=production (or your own flag) in the platform's env settings.

No CI vs hosting split and no change to VARLOCK_IS_CI.

Open question

Item-level warnings only print in varlock load (and alongside errors). varlock run, which is how apps run on these hosts, stays silent, so the warning is mostly seen by people running load while debugging. Should run surface this one?