fix: strip quoted env var values before Zod validation

[devin-ai-integration]

Summary

Infisical export (and some .env loaders) can produce env var values wrapped in literal single quotes, e.g.:

NEXT_PUBLIC_SUPPORT_EMAIL='support@codebuff.com'

This sets the value to the string 'support@codebuff.com' (quotes included), which fails Zod v4's z.email() and z.url() validators at module load time in common/src/env.ts, crashing all downstream imports (SDK, agents, etc.) before any test code runs.

Fix: Add a stripEnvQuotes() function in two places:

1. common/src/env-schema.ts — wraps each process.env.* read in clientProcessEnv so quoted values are sanitized before schema validation. This runs in all environments.
2. sdk/test/setup-env.ts — strips quotes from existing env vars before setting test defaults. This runs only via the test preload.

Review & Testing Checklist for Human

• Bun compile-time injection: The clientProcessEnv comment notes Bun statically replaces process.env.NEXT_PUBLIC_* references. Verify that wrapping them in stripEnvQuotes(process.env.NEXT_PUBLIC_*) doesn't break Bun's compile-time substitution (e.g. in next build or bun build).
• No false positives: Confirm no env var legitimately uses wrapping single/double quotes as part of its value. The function only strips if the first and last characters are matching quote pairs.
• E2E CI passes: The real validation is that the nightly-e2e and freebuff-e2e workflows pass with these changes in place.

Notes

• The stripEnvQuotes logic is duplicated across the two files with slightly different signatures (one returns a value, the other mutates process.env in place). Could be extracted to a shared util if preferred, but kept separate to minimize import surface.
• SDK e2e tests pass locally (28/28). Agent e2e tests that still fail locally do so because of missing API keys (expected without secrets), not env validation.

Link to Devin session: https://app.devin.ai/sessions/703473308c2c41e2a915b61e6c597c30

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring