dotenv run --no-override expands variables with the wrong precedence

从 issue 中描述的 CLI run 路径开始，其中 dotenv_values() 会在环境键被筛选之前展开变量。运行提供的复现，并验证 DOTENV_TEST_BASE 和 DOTENV_TEST_DERIVED 都使用现有的环境值，包括该值为空的情况。

Description

With dotenv run --no-override, a variable can keep its value from the environment while another variable referring to it gets the value from .env. This leaves the child process with inconsistent configuration.

Steps to reproduce

With python-dotenv[cli] installed, run:

import os
import subprocess
import sys
import tempfile
from pathlib import Path

with tempfile.TemporaryDirectory() as directory:
    path = Path(directory) / ".env"
    path.write_text(
        "DOTENV_TEST_BASE=file\n"
        "DOTENV_TEST_DERIVED=${DOTENV_TEST_BASE}/suffix\n"
    )
    env = dict(os.environ)
    env["DOTENV_TEST_BASE"] = "environment"
    env.pop("DOTENV_TEST_DERIVED", None)
    subprocess.run(
        [
            sys.executable, "-m", "dotenv", "-f", str(path),
            "run", "--no-override", sys.executable, "-c",
            "import os; print(os.environ['DOTENV_TEST_BASE']); "
            "print(os.environ['DOTENV_TEST_DERIVED'])",
        ],
        env=env,
        check=True,
    )

Expected behavior

Both values should use the existing environment variable, as they do with load_dotenv(override=False):

environment
environment/suffix

Actual behavior

environment
file/suffix

An existing empty string also reproduces this: the derived value is file/suffix instead of /suffix.

Environment

Reproduced on Windows with Python 3.13.15 and python-dotenv 1.2.3, from commit a00cb2eed0704cd6d2071b2004c37e95ccc86ee5.

Additional context

This is similar to #282, but affects the CLI. run calls dotenv_values(), which expands variables with override=True, before filtering out keys already in the environment. The fix is in #698.

Prepared with OpenAI Codex assistance.