[Bug]: Herd PHP binary hardcodes APP_ENV=local via getenv(), breaking PHPUnit CSRF bypass

### Platform

macOS

### Operating system version

macOS Sequoia 15.2 (24C101)

### System architecture

ARM64 (M1, M2, etc)

### Herd Version

1.26.0

### PHP Version

8.5.1

### Bug description

The bug: Herd's PHP binary hardcodes `APP_ENV=local` via putenv() at startup. This prevents PHPUnit's `` from working because the dotenv immutable repository reads `getenv()` first and finds local.

The fix for Herd: Don't set APP_ENV in the CLI binary at all (it's only useful for FPM/web context), or set it only when running under FPM, not CLI.

The workaround : Add `` to phpunit.xml, which overrides `$_SERVER` and gets picked up before the `PutenvAdapter`.

### Steps to reproduce

```php
test('getenv APP_ENV should not be set by the PHP binary itself', function () {
// Herd's PHP binary injects APP_ENV=local into getenv() before any code runs.
// This prevents PHPUnit's from taking effect because dotenv's
// immutable repository reads getenv() first and locks in 'local'.
expect(getenv('APP_ENV'))->toBe('testing');
});
```

Adding ` ` to phpunit.xml makes the test pass

1. Create any Laravel project served by Herd
2. Run php -r "echo getenv('APP_ENV');" — outputs local
3. Run env -i HOME=$HOME PATH=$PATH php -r "echo getenv('APP_ENV') ?: 'not set';" — outputs not set (proving it's not in the shell environment)
4. Run Herd's PHP with no ini files: "/Users/brian/Library/ApplicationSupport/Herd/bin/php" -n -r "echo getenv('APP_ENV') ?: 'not set';" — still outputs local
5. Run php artisan test — all POST-based feature tests fail with 419 (CSRF token mismatch)

### Relevant log output

```shell

```

Beginne damit, das Verhalten mit Herds PHP-Binary unter Verwendung von `php -n -r "echo getenv('APP_ENV') ?: 'not set';"` zu reproduzieren, und vergleiche es anschließend mit dem im Bericht gezeigten `env -i`-Befehl. Überprüfe das Verhalten anhand von `phpunit.xml` und `php artisan test`; als erledigt gilt die Aufgabe, wenn CLI PHP `APP_ENV=local` nicht mehr erzwingt und die POST-basierten Tests nicht mehr mit 419 fehlschlagen.

Vom Indexierungsmodell aus dem Issue-Text verfasst.