CLI: changeset commands default to JARL_CHANGESET, which is checked first

jarl changeset show/diff/apply/discard take the changeset from -C or
JARL_CHANGESET when no ID is given, and remove takes [ID] SEQ. A changeset
from JARL_CHANGESET is checked before anything uses it (staging included):
it must exist, be open and be the caller's own, so a stale export can't
stage into an applied changeset or into another user's draft that later
got its ID. Commands say on stderr which changeset they use, and apply and
discard remind to unset JARL_CHANGESET. -C and ID arguments are used as
given.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/e2e.sh

@@ -227,6 +227,37 @@ run "changeset apply" 0 $J changeset apply $CS
 expect_dig "staged now live" "192.168.1.80" staged.adbraun.test A
 REV=$($J changeset revert $CS -q)
 run "apply revert changeset" 0 $J changeset apply $REV
+# JARL_CHANGESET: staging and the changeset commands default to it, and
+# it is checked before it is used.
+export JARL_CHANGESET=$($J changeset create "e2e env" -q)
+ENVCS=$JARL_CHANGESET
+run "stage via JARL_CHANGESET" 0 $J record add adbraun.test envstaged A 192.168.1.81
+contains "changeset $ENVCS (e2e env, 0 operations) from JARL_CHANGESET"
+expect_dig "env-staged not live yet" "" envstaged.adbraun.test A
+run "changeset show defaults to it" 0 $J changeset show
+contains "envstaged"
+run "changeset diff defaults to it" 0 $J changeset diff
+contains "apply with 'jarl changeset apply'"
+OTHER=$($J changeset create "e2e other" -q)
+run "-C wins over JARL_CHANGESET" 0 $J changeset show -C $OTHER
+contains "e2e other"
+run "an ID argument wins too" 0 $J changeset discard $OTHER
+run "changeset apply defaults to it" 0 $J changeset apply
+contains "unset JARL_CHANGESET"
+expect_dig "env-staged live" "192.168.1.81" envstaged.adbraun.test A
+run "staging into the applied changeset is refused" 1 $J record add adbraun.test envlate A 192.168.1.82
+contains "changeset $ENVCS is applied"
+run "applying it again is refused" 1 $J changeset apply
+contains "is applied"
+export JARL_CHANGESET=999999
+run "a changeset that doesn't exist is explained" 1 $J record add adbraun.test envlate A 192.168.1.82
+contains "there is no changeset 999999"
+run "reads don't care about a stale JARL_CHANGESET" 0 $J zone list
+unset JARL_CHANGESET
+expect_dig "nothing was staged or applied" "" envlate.adbraun.test A
+run "changeset apply without an ID or JARL_CHANGESET" 1 $J changeset apply
+contains "which changeset?"
+run "clean up envstaged" 0 $J record delete adbraun.test envstaged A --yes
 expect_dig "staged reverted" "" staged.adbraun.test A
 run "history" 0 $J history
 contains "e2e batch"
@@ -285,6 +316,13 @@ run "acme set again (idempotent)" 0 $J $ACME acme set adbraun.test value-one
 run "acme set wildcard second value" 0 $J $ACME acme set '*.adbraun.test' value-two
 expect_dig "acme TXT both" '"value-one" "value-two"' _acme-challenge.adbraun.test TXT
 run "acme token cannot touch A records (exit 3)" 3 $J $ACME record add adbraun.test evil A 192.168.1.66
+# Someone else's changeset in JARL_CHANGESET isn't used, even by an admin.
+THEIRS=$($J $ACME changeset create "certbot's" -q)
+run "another user's changeset from JARL_CHANGESET is refused" 1 env JARL_CHANGESET=$THEIRS $J record add adbraun.test notmine A 192.168.1.83
+contains "is certbot's"
+run "applying it from JARL_CHANGESET is refused" 1 env JARL_CHANGESET=$THEIRS $J changeset apply
+run "-C uses it anyway (admin)" 0 $J changeset show -C $THEIRS
+run "discard certbot's changeset" 0 $J changeset discard $THEIRS
 run "certbot hooks" 0 env CERTBOT_DOMAIN=nas.adbraun.test CERTBOT_VALIDATION=cb-value $J $ACME acme certbot-auth
 expect_dig "certbot TXT" '"cb-value"' _acme-challenge.nas.adbraun.test TXT
 run "certbot cleanup" 0 env CERTBOT_DOMAIN=nas.adbraun.test CERTBOT_VALIDATION=cb-value $J $ACME acme certbot-cleanup