feat(feature-flags): AppConfig-backed gated feature flags (#5059)

* feat(feature-flags): AppConfig-backed gated feature flags

* fix(ci): repoint 'Validate feature flags' step to env-flags.ts after rename

* improvement(feature-flags): drop in-code defaults; fallback resolves a per-flag secret, gating is AppConfig-only

* improvement(feature-flags): make flag names a closed set so every flag requires a fallback secret

* improvement(feature-flags): single FEATURE_FLAGS registry — each entry defines name, description, and fallback in one place

* improvement(feature-flags): fallback is the env secret key (keyof typeof env), resolved to a boolean

scripts/generate-mship-contracts.ts

@@ -9,8 +9,7 @@
 // old per-script `--check`, but accounts for post-generate formatting.
 
 import { spawnSync } from 'node:child_process'
-import { copyFileSync, cpSync, mkdirSync, mkdtempSync, readFileSync, rmSync } from 'node:fs'
-import { tmpdir } from 'node:os'
+import { readFileSync } from 'node:fs'
 import { dirname, join, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
@@ -103,9 +102,7 @@ function runCheck(): void {
   }
 
   if (stale.length > 0) {
-    console.error(
-      `Generated contracts are stale: ${stale.join(', ')}. Run: bun run mship:generate`,
-    )
+    console.error(`Generated contracts are stale: ${stale.join(', ')}. Run: bun run mship:generate`)
     process.exit(1)
   }
   console.log('All generated contracts up to date.')