feat: Add support for environment protection (scrubbing) (#327)

* feat: Add support for environment variable protection for sandbox

* chore: Update dangerous env var list

* fix: Split profiles for improved environment protection

* fix: pipx sandbox profile separation

* chore: Show sandbox scrub info on error exit

* fix: Code review fixes

* test: Add e2e for sandbox environment scrubbing

sandbox/profiles/pnpm.yml

@@ -0,0 +1,42 @@
+name: pnpm
+description: Profile for pnpm, extending npm-restrictive with pnpm write paths and environment variables
+inherits: npm-restrictive
+
+package_managers:
+  - pnpm
+
+environment:
+  # The npm-restrictive base allows no environment variables. pnpm uses the
+  # npm auth and config conventions (.npmrc with env interpolation,
+  # npm_config_*). Sibling tokens (YARN_NPM_AUTH_*, BUN_AUTH_TOKEN) stay
+  # scrubbed.
+  allow:
+    - NPM_TOKEN
+    - NPM_AUTH_TOKEN
+    - NODE_AUTH_TOKEN
+    - npm_config_*
+    - NPM_CONFIG_*
+    - NODE_EXTRA_CA_CERTS
+
+filesystem:
+  allow_write:
+    # pnpm needs write access here
+    - ${HOME}/Library/pnpm/.tools/**
+    - ${HOME}/.pnpm-store/**
+
+    # `pnpm i` creates the tmp files in local dir, at least on MacOS
+    - ${CWD}/_tmp_*
+
+    # pnpm self-update (or likely update) creates temporary package.json files
+    # for writing. This is likely for atomic update using filesystem rename operation
+    # which guarantees atomicity
+    - ${CWD}/package.json.*
+
+    # pnpm install/update writes pnpm-lock.yaml atomically via a sibling
+    # temp file (e.g. pnpm-lock.yaml.139703784) followed by rename.
+    - ${CWD}/pnpm-lock.yaml.*
+
+    # Need access for dependency resolution
+    - ${CWD}/.pnpm-store
+
+