Add CONFIG_LOCAL_DIR overlay so local environments can override config without affecting public Lagoon dev URLs

[ivangrynenko]

Background

scripts/deploy/govcms-config-import currently treats every non-production environment the same way: it imports config/default/ and then overlays config/dev/ via drush config:import --partial.

That means there's no way to disable security-relevant modules such as shield on a developer's local machine without also disabling them on public Lagoon dev/staging/branch URLs — which defeats the point of having shield enabled there.

Proposal

Mirror the existing CONFIG_DEV_DIR pattern with a new optional CONFIG_LOCAL_DIR (default /app/config/local). Apply it as an additional drush config:import --partial step only when LAGOON_ENVIRONMENT_TYPE=local and the directory contains importable YAML.

Overlay order after this change:

1. config/default/ (always, full import)
2. config/dev/ (any non-production env, partial)
3. config/local/ (local env only, partial) — new

Why this shape

• Symmetric with the existing CONFIG_DEV_DIR pattern — no new mental model.
• Opt-in / no-op for projects that don't add a config/local/ directory.
• Gated on LAGOON_ENVIRONMENT_TYPE=local, so public Lagoon dev/staging URLs can never pick up these overrides.
• Doesn't touch drupal/settings/*, so it composes cleanly with any existing settings.local.php.

Acceptance criteria

• CONFIG_LOCAL_DIR env var (default /app/config/local) added to scripts/deploy/govcms-config-import.
• drush config:import --partial --source=$CONFIG_LOCAL_DIR runs only when LAGOON_ENVIRONMENT_TYPE=local AND the directory contains YAML.
• Runs after the CONFIG_DEV_DIR overlay (so local wins).
• No-op on production, development, branch envs, or when the directory is absent/empty.
• Bats coverage for: local+present, local+missing, development+present (regression guard), production+present.
• Header comment in the script documents the new env var and ordering.

Out of scope

• Settings-based runtime overrides (possible follow-up).
• Changing shield defaults in config/default/.
• Adding opinionated local defaults to the scaffold itself.

References

• scaffold-tooling/scripts/govcms-deploy

  Line 84 in d2a68b4

  "$DRUSH" config:import -y --partial --source=../config/dev

• scripts/deploy/govcms-config-import
• https://github.com/govCMS/scaffold-tooling/blob/d2a68b47e2323f83f7f12468859cefdcf9d8ad28/drupal/settings/dev-mode.settings.php

[ivangrynenko]

Implemented in #388 (#388).