feat(sandbox): scrub sensitive environment variables from package managers

Implements process-level environment variable protection per the spec.
When the sandbox is enabled, credential-bearing variables are removed from
the package manager child process before it is spawned, defending against
supply chain attacks that harvest secrets from the environment.

- DANGEROUS_ENV_VARS: curated default deny list of known secret names (no
  generic *_TOKEN/*_SECRET catch-alls); ScrubEnv matcher supports case-
  insensitive globs so profiles can opt into broader denies.
- EnvironmentPolicy (environment.allow / environment.deny) on sandbox
  profiles, merged under inheritance; deep-copied on resolve.
- npm/pypi profiles re-allow their own ecosystem's auth vars so package
  managers keep working; other ecosystems' and cloud creds stay scrubbed.
- New 'env' --sandbox-allow type (and overlay support via the same path):
  allow-only, value kept verbatim (not path-resolved), governed by lockdown.
- Enforced in executor.ApplySandbox as the last step before launch, after
  overlay and runtime overrides merge; scrubbed names logged for audit.

https://claude.ai/code/session_017Da1sAYLYpeEgogm6f9VYW

sandbox/executor/apply.go

@@ -6,6 +6,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"strings"
 
 	"github.com/safedep/dry/log"
 	"github.com/safedep/dry/usefulerror"
@@ -15,6 +16,7 @@ import (
 	"github.com/safedep/pmg/internal/audit"
 	"github.com/safedep/pmg/sandbox"
 	"github.com/safedep/pmg/sandbox/platform"
+	"github.com/safedep/pmg/sandbox/util"
 )
 
 type applySandboxConfig struct {
@@ -164,6 +166,12 @@ func ApplySandbox(ctx context.Context, cmd *exec.Cmd, pmName string, opts ...app
 
 	log.Debugf("Running %s in %s sandbox with policy %s", pmName, sb.Name(), policy.Name)
 
+	// Scrub sensitive environment variables before the child is spawned. This
+	// runs after overlay and runtime overrides are merged into the policy so
+	// user allowances are honored, and is platform-independent (it filters the
+	// env slice regardless of the OS sandbox driver).
+	scrubEnv(cmd, policy)
+
 	result, err := sb.Execute(ctx, cmd, policy)
 	if err != nil {
 		return nil, fmt.Errorf("failed to setup sandbox: %w", err)
@@ -205,10 +213,40 @@ func applyRuntimeOverrides(policy *sandbox.SandboxPolicy, overrides []config.San
 			// Enable AllowNetworkBind so the translator emits bind rules.
 			// Without this, AllowBind entries would be ignored on some platforms.
 			policy.AllowNetworkBind = utils.PtrTo(true)
+
+		case config.SandboxAllowEnv:
+			// Allow-wins: appending to Allow un-scrubs the variable regardless
+			// of whether it was denied by the built-in list or a profile deny
+			// glob, so (unlike the filesystem cases) there is no deny list to
+			// remove an exact match from.
+			log.Infof("Sandbox override: allowing environment variable %s", override.Value)
+			policy.Environment.Allow = append(policy.Environment.Allow, override.Value)
 		}
 	}
 }
 
+// scrubEnv removes sensitive environment variables from cmd.Env per the
+// resolved policy's environment section. It runs after project overlay and
+// runtime overrides are merged into the policy, so user allowances take effect.
+// A nil cmd.Env would mean "inherit the parent environment", which would defeat
+// scrubbing, so it is populated from os.Environ() first.
+func scrubEnv(cmd *exec.Cmd, policy *sandbox.SandboxPolicy) {
+	if cmd.Env == nil {
+		cmd.Env = os.Environ()
+	}
+
+	result := util.ScrubEnv(cmd.Env, util.EnvScrubOptions{
+		Allow: policy.Environment.Allow,
+		Deny:  policy.Environment.Deny,
+	})
+	cmd.Env = result.Env
+
+	if len(result.Removed) > 0 {
+		log.Infof("Sandbox: scrubbed %d sensitive environment variable(s) from %s: %s",
+			len(result.Removed), policy.Name, strings.Join(result.Removed, ", "))
+	}
+}
+
 // removeExactMatch removes entries from the slice that exactly match the given value.
 // Glob patterns and wildcards in the slice are never matched. Only literal string
 // equality is used. This keeps broad deny rules intact while allowing targeted overrides.