dotenv run --no-override expands variables with the wrong precedence

Start with the CLI run path described in the issue, where dotenv_values() expands variables before environment keys are filtered. Run the provided reproduction and verify that DOTENV_TEST_BASE and DOTENV_TEST_DERIVED both use the existing environment value, including when it is empty.

Description

With dotenv run --no-override, a variable can keep its value from the environment while another variable referring to it gets the value from .env. This leaves the child process with inconsistent configuration.

Steps to reproduce

With python-dotenv[cli] installed, run:

import os
import subprocess
import sys
import tempfile
from pathlib import Path

with tempfile.TemporaryDirectory() as directory:
    path = Path(directory) / ".env"
    path.write_text(
        "DOTENV_TEST_BASE=file\n"
        "DOTENV_TEST_DERIVED=${DOTENV_TEST_BASE}/suffix\n"
    )
    env = dict(os.environ)
    env["DOTENV_TEST_BASE"] = "environment"
    env.pop("DOTENV_TEST_DERIVED", None)
    subprocess.run(
        [
            sys.executable, "-m", "dotenv", "-f", str(path),
            "run", "--no-override", sys.executable, "-c",
            "import os; print(os.environ['DOTENV_TEST_BASE']); "
            "print(os.environ['DOTENV_TEST_DERIVED'])",
        ],
        env=env,
        check=True,
    )

Expected behavior

Both values should use the existing environment variable, as they do with load_dotenv(override=False):

environment
environment/suffix

Actual behavior

environment
file/suffix

An existing empty string also reproduces this: the derived value is file/suffix instead of /suffix.

Environment

Reproduced on Windows with Python 3.13.15 and python-dotenv 1.2.3, from commit a00cb2eed0704cd6d2071b2004c37e95ccc86ee5.

Additional context

This is similar to #282, but affects the CLI. run calls dotenv_values(), which expands variables with override=True, before filtering out keys already in the environment. The fix is in #698.

Prepared with OpenAI Codex assistance.