Engine enforces the project variables policy

[futurepastori]

Summary

diff_variables (src/iac/change_set.rs) only skipped when both sides lacked variables: a desired service with no env deleted every remote variable, and preserve() is per key, so variables synced by an external secret manager got deleted. This adds an explicit project-level variables policy so users can say "IaC does not own these variables".

project("example", { variables: { managed: true, ignore: ["SECRETS_*", "web/*"] }, resources: [...] })

Python: project("example", resources=[...], variables={"managed": True, "ignore": [...]}). Go: the project's Variables field. The policy is read from the evaluated project.variables in normalize_project / project_definition_to_graph and carried on RailwayGraph. Absent → { managed: true, ignore: [] }, flagged as default.

Semantics

1. KEY_GLOB matches that key on every service; service/KEY_GLOB only on the named resource. Only * is special, case-sensitive, full-key match. Ignored keys are removed from both sides before diffing: never set, never deleted.
2. managed: false: no variable.set/variable.delete. A service declaring env/variables is an error.
3. managed: true, service with no variables key while Railway has non-ignored variables → error, no deletes. An explicit env: {} stays authoritative. Database behaviour is unchanged.
4. A declared key that also matches an ignore pattern is an error.
5. Malformed patterns, or a service/ prefix naming an unknown resource, are errors.
6. A pattern matching no key on either side is a warning.
7. Plan prints a policy line under the Environment line, e.g. variables: managed · 23 ignored on Railway (SECRETS_* 21, web/* 2). --json gets a top-level variablePolicy { managed, ignore, default, ignoredCount, byPattern }.
8. Pinned plans (--out / --plan) keep working; the policy is part of the evaluated input.

Tests

One test per rule in src/iac/tests.rs.