Function forward_build_arg_env 

pub fn forward_build_arg_env(
    df: &Dockerfile,
    args: &mut BTreeMap<String, String>,
)

Forward declared-but-unset build-args from the process environment.

Docker’s --build-arg FOO (no =value) takes FOO’s value from the builder’s environment. We extend that convenience to every build-arg that is DECLARED in the Dockerfile IR (a pre-FROM global ARG or a per-stage ARG): if such an arg has no effective value in args (absent, or an empty string) and the process environment has a matching non-empty var, the env value is forwarded into args. This is why a declared FORGEJO_TOKEN build-arg populates from $FORGEJO_TOKEN with no explicit --set.

Guarantees:

• Never overrides an explicit non-empty value already in args.
• Only forwards names that are actually declared as build-args — the whole environment is never dumped into the image.
• A no-op when the matching env var is unset or empty (identical to today).

Call this on the merged effective_build_args BEFORE deriving the expansion map so both the --build-arg flags and in-Dockerfile ${VAR} expansion see the forwarded value.