fix(cli): pass repo_root=None to expand_vars in expand_profile_set_vars

Upstream added expand_profile_set_vars in the merge, which called
expand_vars with 2 args. Our branch extended the signature with a
third repo_root argument. Pass None since env var value expansion
does not require $REPO_ROOT resolution.

Signed-off-by: Amit Singh <amitds1997@gmail.com>

Author: amitds1997

CHANGELOG.md

@@ -453,9 +453,9 @@
 
 
 ### Security
-- Sandbox escape on Linux via D-Bus ([GHSA-27vp-2mmc-vmh3](https://github.com/always-further/nono/security/advisories/GHSA-27vp-2mmc-vmh3)) - reported by @cgwalters
+- Sandbox escape on Linux via D-Bus ([GHSA-27vp-2mmc-vmh3](https://github.com/always-further/nono/security/advisories/GHSA-27vp-2mmc-vmh3)) — reported by @cgwalters
 
-GHSA-27vp-2mmc-vmh3
+GHSA-27vp-2mmc-vmh3 
 
 ### Bug Fixes
 
@@ -869,7 +869,7 @@ GHSA-27vp-2mmc-vmh3
 
 ### Features
 
-- *(profile)* #594 phase 2 - canonical JSON schema restructure (#594)
+- *(profile)* #594 phase 2 — canonical JSON schema restructure (#594)
 
 
 ### Performance
@@ -1551,7 +1551,7 @@ GHSA-27vp-2mmc-vmh3
 
 - Allow filesystem.read entries to be files
 
-- *(proxy)* Address review feedback - normalize prefix in CredentialStore
+- *(proxy)* Address review feedback — normalize prefix in CredentialStore
 
 - *(proxy)* Handle route prefixes with leading slashes
 

crates/nono-cli/src/profile_runtime.rs

@@ -467,7 +467,7 @@ fn expand_profile_set_vars(
         let Some(value) = env_config.set_vars.get(key) else {
             continue;
         };
-        let expanded_value = profile::expand_vars(value, workdir)?
+        let expanded_value = profile::expand_vars(value, workdir, None)?
             .to_string_lossy()
             .into_owned();
         expanded.push((key.clone(), expanded_value));