feat(security): sanitize subprocess environment inheritance and scrub credentials

Replace unscrubbed os.environ inheritance with an explicit allowlist
(_SAFE_SUBPROCESS_VARS) containing only variables necessary for bash/python
execution (PATH, locale, terminal, Python virtualenv/site-packages, Windows
essentials) and regex-based credential scrubbing (_SENSITIVE_PATTERN) to
prevent provider tokens, database URLs, and API keys from leaking into child
processes.

src/agent_tools/subprocess_tools.py

@@ -500,8 +500,10 @@ def _owned_spec(cwd: str, env: Optional[dict], timeout: int, readonly_extra: tup
         visible = any(prefix == root or prefix.startswith(root + os.sep) for root in ("/usr", "/etc"))
         if not visible and prefix not in _NAMESPACE_RESERVED_DESTS:
             readonly.append(prefix)
+    from src.tool_execution import _agent_subprocess_env
+    clean_env = _agent_subprocess_env() if env is None else dict(env)
     return containment.agent_spec(
-        cwd, dict(os.environ if env is None else env), timeout,
+        cwd, clean_env, timeout,
         readonly_extra=tuple(dict.fromkeys([*readonly, *readonly_extra])),
     )