Attach one environment to a suite (atomic append)

APPEND one project environment to the suite's attachments, if it is not already there.

Distinct from PATCH /eval-suites/{suiteId} with environmentIds, which REPLACES the whole list. An append built on the replace door is a read-modify-write across two round trips, and a concurrent attach landing in between is silently DETACHED. The compose-and-run path attaches on every launch, which makes that race ordinary rather than theoretical, so the append happens inside one transaction instead.

Idempotent: attaching an already-attached environment reports attached: false and changes nothing, which is what lets a retried launch converge instead of erroring. Subject to the same cap, membership and schedule-pin rules as the replace door — growing a single-environment suite to two is exactly the edit that strands an enabled unpinned schedule.