feat(feature-flags): AppConfig-backed gated feature flags (#5059)

* feat(feature-flags): AppConfig-backed gated feature flags

* fix(ci): repoint 'Validate feature flags' step to env-flags.ts after rename

* improvement(feature-flags): drop in-code defaults; fallback resolves a per-flag secret, gating is AppConfig-only

* improvement(feature-flags): make flag names a closed set so every flag requires a fallback secret

* improvement(feature-flags): single FEATURE_FLAGS registry — each entry defines name, description, and fallback in one place

* improvement(feature-flags): fallback is the env secret key (keyof typeof env), resolved to a boolean

packages/testing/src/mocks/env-flags.mock.ts

@@ -1,15 +1,15 @@
 import { vi } from 'vitest'
 
 /**
- * Static mock module for `@/lib/core/config/feature-flags`.
+ * Static mock module for `@/lib/core/config/env-flags`.
  * All boolean flags default to `false` for safe test isolation.
  *
  * @example
  * ```ts
- * vi.mock('@/lib/core/config/feature-flags', () => featureFlagsMock)
+ * vi.mock('@/lib/core/config/env-flags', () => envFlagsMock)
  * ```
  */
-export const featureFlagsMock = {
+export const envFlagsMock = {
   isProd: false,
   isDev: false,
   isTest: true,

packages/testing/src/mocks/index.ts

@@ -52,13 +52,13 @@ export {
 export { encryptionMock, encryptionMockFns } from './encryption.mock'
 // Env mocks
 export { createEnvMock, createMockGetEnv, defaultMockEnv, envMock } from './env.mock'
+// Env flag mocks
+export { envFlagsMock } from './env-flags.mock'
 // Execution preprocessing mocks (for @/lib/execution/preprocessing)
 export {
   executionPreprocessingMock,
   executionPreprocessingMockFns,
 } from './execution-preprocessing.mock'
-// Feature flag mocks
-export { featureFlagsMock } from './feature-flags.mock'
 // Executor mocks - use side-effect import: import '@sim/testing/mocks/executor'
 // Fetch mocks
 export {