feat: Add support for environment protection (scrubbing) (#327)

* feat: Add support for environment variable protection for sandbox

* chore: Update dangerous env var list

* fix: Split profiles for improved environment protection

* fix: pipx sandbox profile separation

* chore: Show sandbox scrub info on error exit

* fix: Code review fixes

* test: Add e2e for sandbox environment scrubbing

sandbox/resolve.go

@@ -81,6 +81,13 @@ func expandPolicyPaths(p *SandboxPolicy, opts ResolveOptions) (*SandboxPolicy, e
 		AllowBind:     append([]string(nil), p.Network.AllowBind...),
 	}
 
+	// Environment entries are variable-name globs, not paths, so they are
+	// deep-copied without expansion so the caller can safely mutate the result.
+	out.Environment = EnvironmentPolicy{
+		Allow: append([]string(nil), p.Environment.Allow...),
+		Deny:  append([]string(nil), p.Environment.Deny...),
+	}
+
 	out.PackageManagers = append([]string(nil), p.PackageManagers...)
 
 	return &out, nil