feat(sandbox): scrub sensitive environment variables from package managers

Implements process-level environment variable protection per the spec.
When the sandbox is enabled, credential-bearing variables are removed from
the package manager child process before it is spawned, defending against
supply chain attacks that harvest secrets from the environment.

- DANGEROUS_ENV_VARS: curated default deny list of known secret names (no
  generic *_TOKEN/*_SECRET catch-alls); ScrubEnv matcher supports case-
  insensitive globs so profiles can opt into broader denies.
- EnvironmentPolicy (environment.allow / environment.deny) on sandbox
  profiles, merged under inheritance; deep-copied on resolve.
- npm/pypi profiles re-allow their own ecosystem's auth vars so package
  managers keep working; other ecosystems' and cloud creds stay scrubbed.
- New 'env' --sandbox-allow type (and overlay support via the same path):
  allow-only, value kept verbatim (not path-resolved), governed by lockdown.
- Enforced in executor.ApplySandbox as the last step before launch, after
  overlay and runtime overrides merge; scrubbed names logged for audit.

https://claude.ai/code/session_017Da1sAYLYpeEgogm6f9VYW

sandbox/policy.go

@@ -19,9 +19,10 @@ type SandboxPolicy struct {
 
 	// These fields are affected by inheritance and are merged with the parent policy.
 	// Any new values added here should be handled in the MergeWithParent method.
-	Filesystem FilesystemPolicy `yaml:"filesystem" json:"filesystem"`
-	Network    NetworkPolicy    `yaml:"network" json:"network"`
-	Process    ProcessPolicy    `yaml:"process" json:"process"`
+	Filesystem  FilesystemPolicy  `yaml:"filesystem" json:"filesystem"`
+	Network     NetworkPolicy     `yaml:"network" json:"network"`
+	Process     ProcessPolicy     `yaml:"process" json:"process"`
+	Environment EnvironmentPolicy `yaml:"environment" json:"environment"`
 
 	// The boolean fields are pointers to allow for nil values so that the YAML parser
 	// can set the values from the child policy if present. We can differentiate between
@@ -63,6 +64,15 @@ type ProcessPolicy struct {
 	DenyExec  []string `yaml:"deny_exec" json:"deny_exec"`
 }
 
+// EnvironmentPolicy controls which environment variables are scrubbed from the
+// child process. Deny extends the built-in util.DANGEROUS_ENV_VARS list; Allow
+// suppresses matching denies (allow wins). Patterns are case-insensitive name
+// globs. Enforcement happens in sandbox/util.ScrubEnv at process spawn.
+type EnvironmentPolicy struct {
+	Allow []string `yaml:"allow" json:"allow"`
+	Deny  []string `yaml:"deny" json:"deny"`
+}
+
 // Validate validates the sandbox policy for correctness before inheritance resolution.
 // Returns an error if the policy is invalid.
 // Note: Validation for "at least one rule" check is deferred to ValidateResolved(),
@@ -134,6 +144,10 @@ func (child *SandboxPolicy) MergeWithParent(parent *SandboxPolicy) {
 	child.Process.AllowExec = unionStringSlices(parent.Process.AllowExec, child.Process.AllowExec)
 	child.Process.DenyExec = unionStringSlices(parent.Process.DenyExec, child.Process.DenyExec)
 
+	// Union environment lists
+	child.Environment.Allow = unionStringSlices(parent.Environment.Allow, child.Environment.Allow)
+	child.Environment.Deny = unionStringSlices(parent.Environment.Deny, child.Environment.Deny)
+
 	// Set boolean fields by duplicating the parent value if not present in the child.
 	if child.AllowPTY == nil {
 		child.AllowPTY = utils.PtrTo(utils.SafelyGetValue(parent.AllowPTY))