chore(scripts): accept a dynamic SetEnvironmentVariable argument as an override (#2146)

Copilot, ninth review: the .NET arm required a QUOTED second argument, so
`SetEnvironmentVariable("SMOKE_BROWSER", $engine)` — or a ${{ }} expression
there — set the environment with the guard silent. An engine the guard cannot
read is forbidden for the same reason `smoke:web:engine` is, so the arm now
accepts an unquoted value too. Bare values stop at `,` or `)`, so a third
argument ("Process") is not swallowed — pinned by an allowed three-argument
case beside the dynamic one.

Signed-off-by: Cliff Hall <cliff@futurescale.com>
Signed-off-by: cliffhall <cliff@futurescale.com>

scripts/lib/workflow-gate.test.mjs

@@ -230,6 +230,23 @@ describe("findWorkflowViolations", () => {
       ),
       rules: [VIOLATION.BROWSER_ENV],
     },
+    {
+      // Copilot, ninth review: an unquoted second argument sets the environment
+      // just the same, and an engine the guard cannot read is forbidden for the
+      // reason `smoke:web:engine` is.
+      name: "flags a SetEnvironmentVariable call with a dynamic value",
+      text: workflow(
+        '      - run: |\n          [Environment]::SetEnvironmentVariable("SMOKE_BROWSER", $engine)\n          npm run smoke',
+      ),
+      rules: [VIOLATION.BROWSER_ENV],
+    },
+    {
+      name: "allows a SetEnvironmentVariable call pinning chromium",
+      text: workflow(
+        '      - run: |\n          [Environment]::SetEnvironmentVariable("SMOKE_BROWSER", "chromium", "Process")\n          npm run smoke',
+      ),
+      rules: [],
+    },
     {
       name: "flags a .NET SetEnvironmentVariable call",
       text: workflow(