refactor(cli): cover functions download with effect lint (CLI-2459)

[7ttp]

TL;DR

brings supabase functions download, the last uncovered subcommand, under the effect lint

whats introduced?

effect lint applied to download, so the whole functions family is covered now:

• the six functions allow list entries in .oxlintrc.effect.json
  collapse into one !apps/cli/src/commands/functions/**, which adds exactly the five download files
• the handler joins paths through the Path service instead of node:path
• integration and live tests move onto the FileSystem/Path services
• env cases run through withEnvVar instead of setting and restoring process.env by hand, and the ambient env assertion reads through Config over a ConfigProvider.fromEnv
• the project id fixture is a string literal instead of JSON.stringify
• e2e tests run through the effect native runSupabaseEffect harness with withTempHome, live tests through the cliEffect fixture

ref:

• closes: CLI-2459

[github-actions]

🤖 AI Review

Both independent reviews were available. Of Claude's three nit findings, one duplication concern is confirmed and two style/readability claims are refuted by existing repository patterns. Codex reported no findings. No correctness, security, or user-impacting issues were identified.

Findings

Severity	Location	Category	Sources	Claim
⚪ NIT	apps/cli/src/commands/functions/download/download.live.test.ts:16	duplication	claude	The Effect port duplicates the function-cleanup helper and tagged-error pattern across a third functions live test instead of sharing the common responsibility.

Refuted findings (kept for transparency, not posted as review comments)

• apps/cli/src/commands/functions/download/download.integration.test.ts:1916 (style): The three withEnvVar call sites use an inline pipe lambda instead of the repository's prevailing direct-wrapper form, making the environment scope harder to see.
  Refuted: The claimed convention is not borne out by the checked-out code: multiple existing tests use the same inline lambda form, including an exact Effect.provide(layer), (body) => withEnvVar(...) pattern.
• apps/cli/src/commands/functions/download/download.integration.test.ts:953 (readability): Replacing JSON.stringify({ project_id: "json-project" }) with a handwritten JSON literal loses self-documenting structure.
  Refuted: The one-property literal exposes the exact key and value directly, its purpose is explicit from the surrounding filename and assertions, and literal JSON fixtures are an established nearby pattern consistent with the trusted guidance to keep test fixtures concise.

Stats

Claude findings: 3 · Codex findings: 0 · Confirmed: 1 · Refuted: 2 · Uncertain: 0

---

Models: claude-opus-5 + gpt-5.6-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.