docs(test): the integration harness's environment knobs are undocumented

### The gap `test/integration/README.md` documents how to run the suite, but never documents the environment variables that control it. `INTEGRATION_PLUGIN_REF` appears exactly once — as an opaque prefix on a command line in the coverage section — and nothing says what it does or what it defaults to: ```sh sudo INTEGRATION_PLUGIN_REF=ghcr.io/claymore666/docker-net-dhcp:golang-cover make integration-test ``` It is the variable that decides **which plugin the suite actually tests**: ```go // test/integration/harness/plugin.go var PluginRef = func() string { if v := os.Getenv("INTEGRATION_PLUGIN_REF"); v != "" { return v } return "ghcr.io/claymore666/docker-net-dhcp:golang" }() ``` So a local run with the variable unset tests whatever is installed under `:golang` — which may be an older build than the tree you are sitting on. The suite passes, and it tells you nothing about your change. That failure mode is silent, which is what makes it worth a paragraph. ### The task Add a short table of the harness's environment knobs to `test/integration/README.md` — a good spot is near "Running locally". The variables the harness and workflows actually read: | variable | what it does | | --- | --- | | `INTEGRATION_PLUGIN_REF` | which installed plugin the suite drives; default above | | `STATE_DIR` | the plugin's bind-mounted state directory | | `LOG_LEVEL` | plugin log verbosity | | `GOCOVERDIR` | where the instrumented plugin writes coverage counters | Find them with: ```sh grep -rn 'os.Getenv' test/ pkg/ cmd/ grep -rn 'INTEGRATION_PLUGIN_REF' .github/workflows/ ``` Say explicitly what the default means in practice: an unset variable tests the installed `:golang` plugin, not your working tree. ### Why this is a good first issue Self-contained, no privileged access or running suite needed, and it is read rather than guessed — every fact above is in two files. It also removes a way for a newcomer's first test run to mislead them. ### Getting started Branch off `dev` (never `main`), name it `docs/`, and open a PR against `dev`. See the Contributing section of the README.