Function resolve_cli_env 

pub fn resolve_cli_env(
    env_map: &HashMap<String, String>,
    keyring: &Keyring,
    wipe_on_drop: bool,
    ati_dir: &Path,
) -> Result<(HashMap<String, String>, Vec<CredentialFile>), CliError>

Resolve a provider’s cli_env map against the keyring.

Three value forms:

• @{key_ref}: materialize the keyring value as a credential file; env value = file path
• ${key_ref} (possibly inline): substitute from keyring
• plain string: pass through unchanged

Returns the resolved env map and a vec of CredentialFiles whose lifetimes must span the subprocess execution (they are wiped on drop).