feat(sandbox): scrub sensitive environment variables from package managers

Implements process-level environment variable protection per the spec.
When the sandbox is enabled, credential-bearing variables are removed from
the package manager child process before it is spawned, defending against
supply chain attacks that harvest secrets from the environment.

- DANGEROUS_ENV_VARS: curated default deny list of known secret names (no
  generic *_TOKEN/*_SECRET catch-alls); ScrubEnv matcher supports case-
  insensitive globs so profiles can opt into broader denies.
- EnvironmentPolicy (environment.allow / environment.deny) on sandbox
  profiles, merged under inheritance; deep-copied on resolve.
- npm/pypi profiles re-allow their own ecosystem's auth vars so package
  managers keep working; other ecosystems' and cloud creds stay scrubbed.
- New 'env' --sandbox-allow type (and overlay support via the same path):
  allow-only, value kept verbatim (not path-resolved), governed by lockdown.
- Enforced in executor.ApplySandbox as the last step before launch, after
  overlay and runtime overrides merge; scrubbed names logged for audit.

https://claude.ai/code/session_017Da1sAYLYpeEgogm6f9VYW

config/config.go

@@ -298,6 +298,7 @@ const (
 	SandboxAllowExec       SandboxAllowType = "exec"
 	SandboxAllowNetConnect SandboxAllowType = "net-connect"
 	SandboxAllowNetBind    SandboxAllowType = "net-bind"
+	SandboxAllowEnv        SandboxAllowType = "env"
 )
 
 // SandboxAllowOverride represents a single --sandbox-allow flag value.

config/sandbox_allow.go

@@ -16,6 +16,7 @@ var validSandboxAllowTypes = map[SandboxAllowType]bool{
 	SandboxAllowExec:       true,
 	SandboxAllowNetConnect: true,
 	SandboxAllowNetBind:    true,
+	SandboxAllowEnv:        true,
 }
 
 // parseSandboxAllowOverrides parses raw --sandbox-allow flag values into validated overrides.
@@ -69,7 +70,7 @@ func parseSingleOverride(raw string) (SandboxAllowOverride, error) {
 	}
 
 	if !validSandboxAllowTypes[allowType] {
-		return SandboxAllowOverride{}, fmt.Errorf("unknown type %q, valid types: read, write, exec, net-connect, net-bind", typStr)
+		return SandboxAllowOverride{}, fmt.Errorf("unknown type %q, valid types: read, write, exec, net-connect, net-bind, env", typStr)
 	}
 
 	resolved, err := validateAndResolveValue(allowType, value)
@@ -95,11 +96,26 @@ func validateAndResolveValue(typ SandboxAllowType, value string) (string, error)
 		return validateNetConnect(value)
 	case SandboxAllowNetBind:
 		return validateNetBind(value)
+	case SandboxAllowEnv:
+		return validateEnvName(value)
 	default:
 		return "", fmt.Errorf("unhandled type: %s", typ)
 	}
 }
 
+// validateEnvName validates an env allow value. The value is an environment
+// variable name or name glob (e.g. NPM_TOKEN, npm_config_*) and is kept
+// verbatim — unlike filesystem/exec values it is NOT path-resolved, since it
+// matches a variable name and not a filesystem location. Matching is
+// case-insensitive at scrub time, so the value is not normalized here.
+func validateEnvName(value string) (string, error) {
+	if strings.ContainsAny(value, "=/") || strings.ContainsAny(value, " \t") {
+		return "", fmt.Errorf("invalid env variable name %q (expected a name or name glob, e.g. NPM_TOKEN or npm_config_*)", value)
+	}
+
+	return value, nil
+}
+
 // resolveFilesystemPath resolves a filesystem path for read/write overrides.
 // Supports glob patterns. Resolves relative paths to absolute via CWD.
 func resolveFilesystemPath(value string) (string, error) {

config/sandbox_allow_test.go

@@ -94,6 +94,37 @@ func TestParseSandboxAllowOverrides_ValidFormats(t *testing.T) {
 	}
 }
 
+func TestParseSandboxAllowOverrides_Env(t *testing.T) {
+	tests := []struct {
+		name          string
+		raw           string
+		expectedValue string
+	}{
+		{name: "exact name", raw: "env=NPM_TOKEN", expectedValue: "NPM_TOKEN"},
+		{name: "glob name kept verbatim", raw: "env=npm_config_*", expectedValue: "npm_config_*"},
+		{name: "not path resolved", raw: "env=AWS_PROFILE", expectedValue: "AWS_PROFILE"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			overrides, err := parseSandboxAllowOverrides([]string{tt.raw})
+			require.NoError(t, err)
+			require.Len(t, overrides, 1)
+
+			assert.Equal(t, SandboxAllowEnv, overrides[0].Type)
+			// Value is kept verbatim — no CWD/path resolution.
+			assert.Equal(t, tt.expectedValue, overrides[0].Value)
+		})
+	}
+}
+
+func TestParseSandboxAllowOverrides_EnvInvalid(t *testing.T) {
+	for _, raw := range []string{"env=NPM/TOKEN", "env=FOO=BAR", "env=HAS SPACE"} {
+		_, err := parseSandboxAllowOverrides([]string{raw})
+		assert.Error(t, err, "expected error for %q", raw)
+	}
+}
+
 func TestParseSandboxAllowOverrides_MultipleValues(t *testing.T) {
 	raw := []string{
 		"write=./.gitignore",