Constant ENV_ONIRO_CLI 

pub const ENV_ONIRO_CLI: &str = "ONIRO_CLI";

Path to the oniro_cli binary (or a contract-compatible stand-in).

The child shells out to $ONIRO_CLI run … / $ONIRO_CLI eval …; pointing this at the test mock or at the real oniro binary is the only difference between the guarded pipeline test and the real spike.