feat(sandbox): scrub sensitive environment variables from package managers

Implements process-level environment variable protection per the spec.
When the sandbox is enabled, credential-bearing variables are removed from
the package manager child process before it is spawned, defending against
supply chain attacks that harvest secrets from the environment.

- DANGEROUS_ENV_VARS: curated default deny list of known secret names (no
  generic *_TOKEN/*_SECRET catch-alls); ScrubEnv matcher supports case-
  insensitive globs so profiles can opt into broader denies.
- EnvironmentPolicy (environment.allow / environment.deny) on sandbox
  profiles, merged under inheritance; deep-copied on resolve.
- npm/pypi profiles re-allow their own ecosystem's auth vars so package
  managers keep working; other ecosystems' and cloud creds stay scrubbed.
- New 'env' --sandbox-allow type (and overlay support via the same path):
  allow-only, value kept verbatim (not path-resolved), governed by lockdown.
- Enforced in executor.ApplySandbox as the last step before launch, after
  overlay and runtime overrides merge; scrubbed names logged for audit.

https://claude.ai/code/session_017Da1sAYLYpeEgogm6f9VYW

sandbox/policy_env_test.go

@@ -0,0 +1,42 @@
+package sandbox
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestMergeWithParent_Environment(t *testing.T) {
+	parent := &SandboxPolicy{
+		Environment: EnvironmentPolicy{
+			Allow: []string{"NPM_TOKEN"},
+			Deny:  []string{"PARENT_SECRET"},
+		},
+	}
+	child := &SandboxPolicy{
+		Environment: EnvironmentPolicy{
+			Allow: []string{"NODE_AUTH_TOKEN"},
+			Deny:  []string{"CHILD_SECRET"},
+		},
+	}
+
+	child.MergeWithParent(parent)
+
+	assert.Equal(t, []string{"NPM_TOKEN", "NODE_AUTH_TOKEN"}, child.Environment.Allow)
+	assert.Equal(t, []string{"PARENT_SECRET", "CHILD_SECRET"}, child.Environment.Deny)
+}
+
+func TestResolveProfile_DeepCopiesEnvironment(t *testing.T) {
+	r, err := newDefaultProfileRegistry()
+	assert.NoError(t, err)
+
+	resolved, err := r.ResolveProfile("npm-restrictive", ResolveOptions{})
+	assert.NoError(t, err)
+
+	// Mutating the resolved copy must not corrupt the registry-cached policy.
+	resolved.Environment.Allow = append(resolved.Environment.Allow, "MUTATED")
+
+	again, err := r.ResolveProfile("npm-restrictive", ResolveOptions{})
+	assert.NoError(t, err)
+	assert.NotContains(t, again.Environment.Allow, "MUTATED")
+}