refactor(windows): retire $envResult return pattern in New-DreamEnv — 3 of 4 fields have zero readers

[yasinBursali]

Summary

installers/windows/lib/env-generator.ps1 function New-DreamEnv returns a hashtable with 4 fields:

return @{
    EnvPath        = $envPath
    SearxngSecret  = $searxngSecret
    OpenclawToken  = $openclawToken
    DreamAgentKey  = $dreamAgentKey
}

Only SearxngSecret (phase 06 line 162) and OpenclawToken (phase 06 line 181) are actually consumed. EnvPath and DreamAgentKey have zero readers across all Windows installer phases — verified via grep over installers/windows/.

Severity: Low — pure code hygiene, no runtime impact.
Category: Refactor / Code Hygiene
Platform: Windows only

Background

Fork issue #395 originally flagged $envResult.DashboardKey as dead (zero readers). PR-5's fix removed DashboardKey and added DreamAgentKey — which is also dead. This is a rename, not a resolution of the underlying pattern: the hashtable return API has grown past what any caller needs.

Stale header comments in install-windows.ps1:168, phases/06-directories.ps1:19, and phases/07-devtools.ps1:13 currently document fields that aren't actually consumed.

Affected

• dream-server/installers/windows/lib/env-generator.ps1 — function New-DreamEnv (the return shape).
• dream-server/installers/windows/install-windows.ps1:168 — orchestrator header comment.
• dream-server/installers/windows/phases/06-directories.ps1:19,40-46 — writes-header comment + dry-run placeholder.
• dream-server/installers/windows/phases/07-devtools.ps1:13 — reads-header comment (lists OpenclawToken, DreamAgentKey but phase 07 reads neither).

Suggested approach

Option A — Tuple return (preserve explicit contract). Return a PSCustomObject with only the two fields consumers actually read:

return [PSCustomObject]@{
    SearxngSecret = $searxngSecret
    OpenclawToken = $openclawToken
}

Update the 3 header comments to match. Minimal change, clean API.

Option B — Remove return entirely. Have callers read secrets from .env directly (Select-String on the written file). New-DreamEnv becomes pure side-effect. Cleaner, but more parsing logic at call sites.

Option A is the simpler refactor; Option B is the more decoupled end-state.

Out of scope

• Doesn't change runtime behavior or .env generation.
• Doesn't touch Linux/macOS installers (env-generator.sh has a different pattern).

Discovery

Observed during 23APR PR-5 adversarial audit by analysis team. Operator confirmed this belongs as a standalone cleanup follow-up, not bundled into PR-5 (which closes #395 literally by removing DashboardKey; the surface-replacement with DreamAgentKey is acknowledged to be renaming one dead field to another).

[yasinBursali]

Addressed in upstream PR Light-Heart-Labs#1012.