What

Fixes silent data corruption in the env-file round-trip used by the CLI setup wizard. Values that contain quotes, newlines, or backslashes are no longer mangled when written and read back.

Why

sre_agent.cli.env._escape_env_value wraps values containing whitespace in double quotes, but it never escapes embedded " or \ characters. read_env_file then strips outer quotes unconditionally with .strip("\"'"). This makes several realistic inputs corrupt on the first round-trip, and the corrupted value is persisted the next time the wizard runs:

Repro (on main, before this change):

>>> from sre_agent.cli.env import read_env_file, write_env_file
>>> from pathlib import Path
>>> p = Path("/tmp/t.env")
>>> write_env_file(p, {"API_KEY": '"quoted"'})
>>> read_env_file(p)["API_KEY"]
'quoted'            # data silently mutated

Anthropic / GitHub / Slack tokens, AWS access keys, and proxy URLs can all contain characters that trip this: e.g. a wizard user pasting an accidentally-quoted secret has it silently unquoted on the next read, and the fixed-up value overwrites the original on the next wizard run.

How

• _escape_env_value now quotes whenever any shell-special char appears (whitespace, ", ', \, leading #) and escapes embedded \, ", \n, \r, and \t.
• A new _decode_double_quoted helper decodes the body of a double-quoted value in a single pass (unknown escapes are preserved verbatim, matching common .env parsers).
• read_env_file delegates quote handling to _unescape_env_value, which only unwraps values that are surrounded by matching quotes — unquoted values that happen to contain a leading/trailing quote are preserved.
• Legacy single-quoted values (KEY='value with space') still read cleanly.

Extra

Adds tests/test_env.py covering:

• All four corruption cases above
• write → read → write → read idempotency on "quoted"
• Round-trip for unmodified unrelated keys
• Deletion via empty value
• Legacy single-quoted reads

No new dependencies.

Checklist

• I have run application tests ensuring nothing has broken. (uv run pytest tests/ → 17 passed)
• I have updated the documentation if required. (Docstrings updated; user-facing behaviour unchanged for valid values.)
• I have added tests which cover my changes.

Also verified locally:

• uv tool run ruff check src/sre_agent/cli/env.py tests/test_env.py → clean
• uv tool run ruff format --check → clean
• uv run mypy src/sre_agent/cli/env.py → Success: no issues found in 1 source file

Type of change

Bug fix.