Function resolve_prepare_env 

pub fn resolve_prepare_env(
    namespace: &Namespace,
    secrets: &BTreeMap<String, String>,
    service: &str,
    substrate: &str,
    spec: &Service,
) -> Result<Option<PreparePlan>, PrepareFailure>

Resolve a service’s prepare env against namespace and inject same-named secrets. The caller builds the namespace — substrates differ in what it carries (only Render exports the external-DB url) — so this stays pure and substrate-agnostic. Any failure is the neutral PrepareFailure.