Merge remote-tracking branch 'origin/master' into dev

Brings the go2rtc security fixes from #24658 to dev. Dev-specific changes
in the merge:
- frigate/config/env.py stays deleted; the environment_vars protection for
  GO2RTC_ALLOW_ARBITRARY_EXEC moves to apply_config_env_vars in
  frigate/util/env.py, so the value never reaches os.environ
- services.py imports substitute_frigate_vars from frigate.util.env and
  maps UnknownVariableError to the unknown variable message
- go2rtc stream tests patch dev's import-time exec override snapshot and
  its FRIGATE_* variable sources
- test_http_media.py keeps dev's _insert_recording helper; the one added
  on master replaced it and broke the dev tests

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

frigate/util/env.py

@@ -165,12 +165,25 @@ def reload_sources(warn: bool = True) -> None:
     _rebuild(warn)
 
 
+# Security overrides that must come from the container environment, which is
+# controlled by the operator, rather than from the config, which admins can edit
+_PROTECTED_ENV_VARS = frozenset({"GO2RTC_ALLOW_ARBITRARY_EXEC"})
+
+
 def apply_config_env_vars(values: Mapping[str, object]) -> None:
     """Install the environment_vars block as the lowest priority source.
 
-    Unprefixed keys only set os.environ.
+    Unprefixed keys only set os.environ. Protected security overrides are
+    skipped.
     """
     for key, value in values.items():
+        if key.upper() in _PROTECTED_ENV_VARS:
+            logger.warning(
+                "Ignoring %s in environment_vars, it must be set in the container environment",
+                key,
+            )
+            continue
+
         resolved = str(value)
 
         if key.startswith("FRIGATE_"):