fix: acknowledge pi maintenance barrier

tools/thothctl/internal/config/installation.go

@@ -164,6 +164,16 @@ func (i Installation) SecretFiles() ([]string, error) {
 	return files, nil
 }
 
+// EnvironmentValue returns one declared installation value without exposing dotenv parsing to
+// callers. It is used only for operator-visible file locations, never for secret content.
+func (i Installation) EnvironmentValue(name string) (string, error) {
+	contents, err := safeio.ReadCanonicalRegular(i.EnvFile, maxEnvironmentFileBytes)
+	if err != nil { return "", errors.New("installation environment could not be read") }
+	values, err := parseComposeDotenv(contents)
+	if err != nil { return "", errors.New("installation environment could not be read") }
+	return values[name], nil
+}
+
 func parseComposeDotenv(contents []byte) (map[string]string, error) {
 	dotenvParseMu.Lock()
 	defer dotenvParseMu.Unlock()