feat: Support RFC extensions in environment templates

[leongdl]

What was the problem/requirement? (What/Why)

The run and check commands accept an --extensions allow-list, but that list was only applied when decoding job templates. Environment templates were always decoded against the default model surface, ignoring the requested extensions. As a result, an environment template that declares an extension (for example WRAP_ACTIONS from RFC 0008, or EXPR from RFCs 0005/0006) was rejected with a validation error even when the user explicitly requested that extension on the command line.

Additionally, EXPR and WRAP_ACTIONS were not present in the CLI's SUPPORTED_EXTENSIONS allow-list, so they could not be enabled at all.

What was the solution? (How)

• Added EXPR and WRAP_ACTIONS to SUPPORTED_EXTENSIONS in _common/_extensions.py. WRAP_ACTIONS implies EXPR; the model library handles that implication when parsing.
• read_environment_template() in _common/_validation_utils.py now accepts an optional, keyword-only supported_extensions argument and forwards it to decode_environment_template. When omitted, the previous behavior (default model surface only) is preserved.
• do_run (_run/_run_command.py) and do_check (_check/_check_command.py) now pass the parsed extensions when decoding environment templates, matching how job templates are already handled.

What is the impact of this change?

Environment templates that declare supported extensions now validate and run correctly through openjd run --environment ... and openjd check ..., consistent with job-template behavior. Behavior is unchanged for templates that do not declare extensions.

How was this change tested?

See DEVELOPMENT.md for information on running tests.

• Have you run the tests? Yes. hatch run lint (ruff, black --check, mypy) passes clean, and the full unit test suite passes: 289 passed, 2 skipped, total coverage 93.4% (above the 92% gate).

Was this change documented?

• Are relevant docstrings in the code base updated? Yes. The read_environment_template docstring documents the new supported_extensions argument, and inline comments at each call site explain why extensions are forwarded.

Is this a breaking change?

No. read_environment_template gained a new optional keyword-only parameter that defaults to the previous behavior, so existing callers are unaffected. No public contract is changed in a backwards-incompatible way.

Does this change impact security?

No. The change only forwards an existing, user-supplied extension allow-list to the environment-template decoder; it does not create or modify files/directories or alter permission handling.

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.