Deno test runner permission isolation for credential-free integration tests

The goal is to run Deno integration tests without exposing production credentials while still allowing controlled network access to test doubles.

Deno test runner applies CLI permission flags per invocation. Deno.env.get accesses the real process environment when env permission is granted, and the API is global with no built-in per-test override. The runtime does not provide a standard test mock for environment variables or network clients, so credential-free execution depends on permission configuration rather than injection.

Permission flags are process-wide for a test run, so denying env can break tests that legitimately need non-secret configuration, and denying network prevents reaching remote test doubles. Deno does not prescribe a canonical credential-free integration testing pattern.

What design is preferred for keeping non-secret configuration available when env permission is denied? How should mixed test suites be handled when some tests require env access and others must not? Is there a documented pattern for credential-free integration testing in Deno?