feat: Upwards-recursively read .braintrust.json containing BRAINTRUST_API_KEY

[Luca Forstner (lforst)]

Direct port of braintrustdata/braintrust-sdk-javascript#2049

Prompt used:

Implement `.env.braintrust` API key discovery for this Braintrust SDK.

Context:
The Braintrust instrumentation wizard will generate a file named `.env.braintrust` in the user’s current working directory. That file contains a dotenv-style `BRAINTRUST_API_KEY=...` entry. The goal is that after running the wizard, users can immediately run or verify local Braintrust instrumentation without manually exporting `BRAINTRUST_API_KEY`.

`.env.braintrust` is not a general dotenv loader. It is only a credential fallback for Braintrust SDK API-key lookup.

Required behavior:
- Preserve precedence:
  1. Explicit caller-provided API key wins.
  2. Nonblank `BRAINTRUST_API_KEY` from the process environment wins.
  3. Otherwise, read `BRAINTRUST_API_KEY` from `.env.braintrust`.
- Treat missing, empty, or whitespace-only environment values as unset.
- Look for `.env.braintrust` starting at the current working directory at lookup time, then walk upward.
- Cap lookup at cwd plus 64 parent directories.
- The nearest `.env.braintrust` wins.
- The nearest `.env.braintrust` is a boundary: if it exists but has no nonblank `BRAINTRUST_API_KEY`, do not check higher parents.
- If the nearest `.env.braintrust` cannot be read, return “not found” and do not check higher parents. Do not throw from credential discovery.
- Read only `BRAINTRUST_API_KEY`; do not load or expose other variables from the file.
- Do not mutate the process environment.
- Support normal dotenv syntax if the SDK/runtime has a standard parser: quotes, comments, and `export BRAINTRUST_API_KEY=...`.

Implementation guidance:
- Prefer lazy, nonblocking lookup.
- If possible, start candidate file reads in parallel, but preserve nearest-wins semantics: a higher parent may only win after all closer candidates are known absent.
- If a constructor/setup path is synchronous, do not add blocking file IO there.
- For telemetry/exporter integrations, make export/flush wait for API-key discovery when needed.

Look at the reference implementation PR: https://github.com/braintrustdata/braintrust-sdk-javascript/pull/2049

[Luca Forstner (lforst)]

There's a good chance this PR is garbage. Sorry.

[Stephen Belanger (Qard)]

Luca Forstner (@lforst) Needs a rebase.

[Stephen Belanger (Qard)]

Now tests fail. Looks like there's some sort of module validation thing.

[Luca Forstner (lforst)]

Stephen Belanger (@Qard) while I fix this, mind still giving a review for general direction?

[Stephen Belanger (Qard)]

Not convinced we need to be so lenient about the format of the file. It's our own named file so we should be able to set a specific format for it, should we not?

[Stephen Belanger (Qard)]

Mixing with and without export seems fragile enough, but throwing YAML into the mix seems a bit questionable. We're specifically reading a file of our own custom naming, so we should have full say what the format of the contents are, should we not? Seems to me like we should just pick one form and stick to it.

[Luca Forstner (lforst)]

Similar to ruby, I switched the implementation to pick up a .braintrust.json file instead. Good input though.