Filter environment variables in both sandbox modes

Whitelist mode now clears the parent env and re-adds a small allowlist
(identity, terminal, locale, proxy, non-GUI XDG, vendor prefixes).
Blacklist mode strips cloud credentials, backup passphrases, dangling
socket pointers, and anything matching *_TOKEN, *_SECRET, *_PASSWORD,
*_PASSPHRASE, *_API_KEY, *_PRIVATE_KEY, *_CLIENT_SECRET; vendor prefix
carve-outs keep ANTHROPIC_API_KEY and friends.

Users can override via --setenv KEY=VALUE and --unsetenv KEY (and the
corresponding TOML keys), or opt out of the built-in policy entirely
with --no-env-filter.

config-example.toml

@@ -12,6 +12,8 @@ rw = [
     "~/.cargo",
     "~/.rustup",
 ]
+setenv = { DATABASE_URL = "postgres://localhost/dev" }
+unsetenv = ["HTTP_PROXY", "HTTPS_PROXY"]
 entrypoint = ["claude", "--dangerously-skip-permissions"]
 
 [profile.blacklist]