feat: Add support for environment protection (scrubbing) (#327)

* feat: Add support for environment variable protection for sandbox

* chore: Update dangerous env var list

* fix: Split profiles for improved environment protection

* fix: pipx sandbox profile separation

* chore: Show sandbox scrub info on error exit

* fix: Code review fixes

* test: Add e2e for sandbox environment scrubbing

sandbox/sandbox.go

@@ -57,8 +57,9 @@ type violationReporter interface {
 // additional metadata (e.g., exit codes, resource usage, violation events).
 // Callers must call Close() after cmd.Run() completes to clean up resources.
 type ExecutionResult struct {
-	executed bool
-	sandbox  Sandbox
+	executed         bool
+	sandbox          Sandbox
+	scrubbedEnvCount int
 }
 
 // ExecutionResultOpt is a function that can be used to configure an ExecutionResult.
@@ -93,6 +94,23 @@ func (r *ExecutionResult) ShouldRun() bool {
 	return !r.executed
 }
 
+// SetScrubbedEnvCount records how many environment variables were scrubbed
+// from the child process per the resolved environment policy.
+func (r *ExecutionResult) SetScrubbedEnvCount(count int) {
+	r.scrubbedEnvCount = count
+}
+
+// ScrubbedEnvCount returns how many environment variables were scrubbed from
+// the child process. Used to hint at scrubbing as a possible cause when the
+// child fails.
+func (r *ExecutionResult) ScrubbedEnvCount() int {
+	if r == nil {
+		return 0
+	}
+
+	return r.scrubbedEnvCount
+}
+
 // BestEffortViolation returns sandbox-specific best-effort violation details.
 // Implementations may use platform logs or other weak signals, so callers
 // should treat the result as advisory.