Function session_env 

pub(crate) fn session_env(
    project: &LoadedProject,
    account_env: &HashMap<String, String>,
) -> HashMap<String, String>

Complete [env] < [accounts.env] < the project’s env, narrowest winning per key, over the already-merged account_env. Applied here rather than at load because one account serves many projects, so merging earlier would leak a project’s keys into every other project on that account.