feat(sandbox): scrub sensitive environment variables from package managers

Implements process-level environment variable protection per the spec.
When the sandbox is enabled, credential-bearing variables are removed from
the package manager child process before it is spawned, defending against
supply chain attacks that harvest secrets from the environment.

- DANGEROUS_ENV_VARS: curated default deny list of known secret names (no
  generic *_TOKEN/*_SECRET catch-alls); ScrubEnv matcher supports case-
  insensitive globs so profiles can opt into broader denies.
- EnvironmentPolicy (environment.allow / environment.deny) on sandbox
  profiles, merged under inheritance; deep-copied on resolve.
- npm/pypi profiles re-allow their own ecosystem's auth vars so package
  managers keep working; other ecosystems' and cloud creds stay scrubbed.
- New 'env' --sandbox-allow type (and overlay support via the same path):
  allow-only, value kept verbatim (not path-resolved), governed by lockdown.
- Enforced in executor.ApplySandbox as the last step before launch, after
  overlay and runtime overrides merge; scrubbed names logged for audit.

https://claude.ai/code/session_017Da1sAYLYpeEgogm6f9VYW

sandbox/profiles_env_test.go

@@ -0,0 +1,61 @@
+package sandbox
+
+import (
+	"testing"
+
+	"github.com/safedep/pmg/sandbox/util"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestProfileEnvContract pins the §2 accepted-risk trade-off as a regression
+// test: each ecosystem profile re-allows its own publishing token but keeps
+// other ecosystems' and cloud credentials scrubbed.
+func TestProfileEnvContract(t *testing.T) {
+	r, err := newDefaultProfileRegistry()
+	require.NoError(t, err)
+
+	env := []string{
+		"NPM_TOKEN=x",
+		"NODE_AUTH_TOKEN=x",
+		"TWINE_PASSWORD=x",
+		"AWS_SECRET_ACCESS_KEY=x",
+		"GITHUB_TOKEN=x",
+	}
+
+	tests := []struct {
+		profile      string
+		wantKept     []string
+		wantScrubbed []string
+	}{
+		{
+			profile:      "npm-restrictive",
+			wantKept:     []string{"NPM_TOKEN", "NODE_AUTH_TOKEN"},
+			wantScrubbed: []string{"TWINE_PASSWORD", "AWS_SECRET_ACCESS_KEY", "GITHUB_TOKEN"},
+		},
+		{
+			profile:      "pypi-restrictive",
+			wantKept:     []string{"TWINE_PASSWORD"},
+			wantScrubbed: []string{"NPM_TOKEN", "NODE_AUTH_TOKEN", "AWS_SECRET_ACCESS_KEY", "GITHUB_TOKEN"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.profile, func(t *testing.T) {
+			policy, err := r.ResolveProfile(tt.profile, ResolveOptions{})
+			require.NoError(t, err)
+
+			result := util.ScrubEnv(env, util.EnvScrubOptions{
+				Allow: policy.Environment.Allow,
+				Deny:  policy.Environment.Deny,
+			})
+
+			for _, name := range tt.wantKept {
+				assert.Contains(t, result.Env, name+"=x", "%s should keep %s", tt.profile, name)
+			}
+			for _, name := range tt.wantScrubbed {
+				assert.Contains(t, result.Removed, name, "%s should scrub %s", tt.profile, name)
+			}
+		})
+	}
+}