Refactor plugin config -> envar generation

[moskyb]

Description

I was in this code investigating an escalation, and found it quite hard to parse out what was going on, so i did a couple of light refactors to make it a little easier to follow. It stops the envar generation process from reparsing lists of envars, and generally shuffles things around a wee bit.

This PR is fairly low-value, and at best has no impact on the agent at runtime. I'm happy to close it and move on with my life, if we want.

Testing

• Tests have run locally (with go test ./...). Buildkite employees may check this if the pipeline has run automatically.
• Code is formatted (with go tool gofumpt -extra -w .)

Disclosures / Credits

There was a wee bit of Amp (Claude Opus 4.5) involved in minor refactors, name choosing etc.

[zhming0]

Looks good to me, much easier to read! I wonder if we can just have one tiny e2e test case that uses some plugin? just so this code path is test covered.

[moskyb]

i'm going to merge this as-is, as adding an e2e test for this is surprisingly tricky — we have to custom-make a plugin to be able to ensure that config is created the right way.