feat(sandbox): scrub sensitive environment variables from package managers

Implements process-level environment variable protection per the spec.
When the sandbox is enabled, credential-bearing variables are removed from
the package manager child process before it is spawned, defending against
supply chain attacks that harvest secrets from the environment.

- DANGEROUS_ENV_VARS: curated default deny list of known secret names (no
  generic *_TOKEN/*_SECRET catch-alls); ScrubEnv matcher supports case-
  insensitive globs so profiles can opt into broader denies.
- EnvironmentPolicy (environment.allow / environment.deny) on sandbox
  profiles, merged under inheritance; deep-copied on resolve.
- npm/pypi profiles re-allow their own ecosystem's auth vars so package
  managers keep working; other ecosystems' and cloud creds stay scrubbed.
- New 'env' --sandbox-allow type (and overlay support via the same path):
  allow-only, value kept verbatim (not path-resolved), governed by lockdown.
- Enforced in executor.ApplySandbox as the last step before launch, after
  overlay and runtime overrides merge; scrubbed names logged for audit.

https://claude.ai/code/session_017Da1sAYLYpeEgogm6f9VYW

sandbox/profiles/npm-restrictive.yml

@@ -93,6 +93,22 @@ network:
   deny_outbound:
     - "*:*"
 
+environment:
+  # Credential-bearing variables are scrubbed by default (see the built-in
+  # DANGEROUS_ENV_VARS list). Re-allow only the variables the npm ecosystem
+  # legitimately needs for auth, registry config, and TLS.
+  #
+  # Accepted trade-off: a malicious JS package executed during install can read
+  # the npm publishing token below, but NOT PyPI tokens, AWS keys, or other
+  # cloud/secret-manager credentials, which remain scrubbed.
+  allow:
+    - NPM_TOKEN
+    - NPM_AUTH_TOKEN
+    - NODE_AUTH_TOKEN
+    - npm_config_*
+    - NPM_CONFIG_*
+    - NODE_EXTRA_CA_CERTS
+
 process:
   allow_exec:
     - /usr/bin/node

sandbox/profiles/pypi-restrictive.yml

@@ -71,6 +71,22 @@ network:
   deny_outbound:
     - "*:*"
 
+environment:
+  # Credential-bearing variables are scrubbed by default (see the built-in
+  # DANGEROUS_ENV_VARS list). Re-allow only the variables the PyPI ecosystem
+  # legitimately needs for index auth, publishing, and TLS.
+  #
+  # Accepted trade-off: a malicious Python package executed during install can
+  # read the PyPI publishing credentials below, but NOT npm tokens, AWS keys, or
+  # other cloud/secret-manager credentials, which remain scrubbed.
+  allow:
+    - TWINE_USERNAME
+    - TWINE_PASSWORD
+    - TWINE_REPOSITORY*
+    - PIP_*
+    - UV_*
+    - POETRY_*
+
 process:
   allow_exec:
     - /usr/bin/python*