probe: discover environments from manifests, not a hardcoded list

The environment list was written out four times — probe.py's shim tuple and its
results dict, tests/test_probe.py's ENVIRONMENTS, and ci.yml's wheel loop — so
adding an environment meant four edits and five workstreams collided on three
files. Discovery is now a tomllib scan of environments/*/pyproject.toml plus a
@probes(name) registry, with an optional [tool.arena] tasksets key for one
package that ships several (tera_spatial declares four).

An environment discovered without a registered probe WARNS rather than exits 1,
because interactive environments land their engine before their probe. That is
temporary; it becomes a hard failure with the last registration.

The warning is not a licence to stop being gated. test_probe.py pins the
ungated set to an explicit PENDING_PROBES allowlist that only ever shrinks —
without it, removing a @probes decorator moved the name from the table into a
warning line that already carries five, and every remaining assertion stayed
vacuously true while the environment silently stopped being gated.

Also untracks three environments/*/uv.lock files, which had been failing the
lock-policy step on main.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -23,7 +23,16 @@ jobs:
           python-version: ${{ matrix.python }}
       - name: Enforce library lock policy
         run: test -z "$(find environments -name uv.lock -print -quit)"
-      - name: Run four-environment floor and ceiling probe
+      # An environment is `environments/*/pyproject.toml` and nothing else — the same
+      # denominator probe.py's discover() uses. A half-created scaffold directory with no
+      # manifest is invisible to both, so the two can never disagree about what exists.
+      - name: Refuse an empty environment scan
+        run: |
+          set -euo pipefail
+          count=$(find environments -mindepth 2 -maxdepth 2 -name pyproject.toml | wc -l)
+          echo "discovered $count environment manifests"
+          test "$count" -gt 0
+      - name: Run the floor and ceiling probe for every discovered environment
         run: uv run --with regex python probe.py
       - name: Run root probe integration test
         run: uv run --with regex python -m unittest discover -s tests -v
@@ -35,7 +44,9 @@ jobs:
           python -m unittest discover -s environments/redaction_pressure/tests -v
       - name: Build all environment distributions
         run: |
-          for environment in redaction_pressure canary_trap fault_localisation schema_migration bot_detection grand_exchange drop_table_inference; do
+          set -euo pipefail
+          for manifest in environments/*/pyproject.toml; do
+            environment=$(basename "$(dirname "$manifest")")
             uv build "environments/$environment" --out-dir "dist/$environment"
           done
       - name: Verify documented Redaction Pressure entrypoint