Spec improvements: custom environment variables, command templating, non-scalar config values, job-bounded API keys

[kofalt]

Starting point. Needs docs on api-key interaction, how the templating works, config --> environment variables, and some other stuff.

---

Is this a semantic or operational change? If so:

• [ ] Increment the version in spec/readme.md
• [ ] After merge, tag the version and update the release page