build() throws if reading the environment fails #39

Builder.build() is documented as "Never throws", but a failure while reading the environment escapes from it.

Where: src/main/java/software/stephenson/trace/TraceClient.java, the private constructor and disabledReason(Builder, ServerWideConfig). Both call environmentDisables(), which calls environment.apply(...) with nothing around it. The environment field is System::getenv, and System.getenv(String) throws SecurityException when a SecurityManager denies RuntimePermission("getenv.<name>"). That exception propagates through new TraceClient(this) out of build(), and it is reachable from TraceClient.disabled() too.

This was found by reading the code during PR #38. It has not been reproduced under a real SecurityManager. The failure mode is limited to hosts that run one, which is uncommon, and SecurityManager is deprecated since Java 17.

Options for the maintainer (this touches the opt-out contract, so it needs a human decision):

• catch the failure and treat the environment as opting out, reason environment. An environment that cannot be read cannot be said to allow reporting, but this adds a new way for that reason to appear;
• catch the failure and treat the environment as not opting out. This matches the rule that an IO failure on the server-wide file counts as enabled, but it could report for someone whose DO_NOT_TRACK=1 could not be seen; or
• keep the behaviour and narrow the "Never throws" wording in the build() Javadoc.

This issue was drafted during a Gardener session (https://github.com/Stephenson-Software/gardener).

drafted by Claude on behalf of Daniel Stephenson