Add a design spec for scrubbing sensitive environment variables from
package-manager child processes, mirroring the DANGEROUS_FILES model:
built-in default deny list, per-profile allow overrides, enforced at the
ApplySandbox chokepoint. Motivated by the Miasma/Shai-Hulud toolkit's
env-based credential harvesting.
https://claude.ai/code/session_017Da1sAYLYpeEgogm6f9VYW
