Filter environment variables in both sandbox modes

Whitelist mode now clears the parent env and re-adds a small allowlist
(identity, terminal, locale, proxy, non-GUI XDG, vendor prefixes).
Blacklist mode strips cloud credentials, backup passphrases, dangling
socket pointers, and anything matching *_TOKEN, *_SECRET, *_PASSWORD,
*_PASSPHRASE, *_API_KEY, *_PRIVATE_KEY, *_CLIENT_SECRET; vendor prefix
carve-outs keep ANTHROPIC_API_KEY and friends.

Users can override via --setenv KEY=VALUE and --unsetenv KEY (and the
corresponding TOML keys), or opt out of the built-in policy entirely
with --no-env-filter.

src/lib.rs

@@ -2,6 +2,7 @@ mod agents;
 mod blacklist;
 pub mod cli;
 pub mod config;
+mod env;
 mod errors;
 mod preflight;
 mod sandbox;
@@ -9,7 +10,6 @@ mod seccomp;
 
 pub use errors::SandboxError;
 
-use std::env;
 use std::ffi::OsString;
 use std::fs;
 use std::os::unix::process::CommandExt;
@@ -25,9 +25,12 @@ pub struct SandboxConfig {
     pub hardened: bool,
     pub unshare_net: bool,
     pub seccomp: bool,
+    pub env_filter: bool,
     pub extra_rw: Vec<PathBuf>,
     pub extra_ro: Vec<PathBuf>,
     pub mask: Vec<PathBuf>,
+    pub setenv: Vec<(String, String)>,
+    pub unsetenv: Vec<String>,
     pub bwrap_args: Vec<String>,
     pub command: PathBuf,
     pub command_args: Vec<OsString>,
@@ -36,14 +39,14 @@ pub struct SandboxConfig {
 }
 
 pub fn require_home() -> Result<String, SandboxError> {
-    env::var("HOME")
+    std::env::var("HOME")
         .ok()
         .filter(|h| !h.is_empty())
         .ok_or(SandboxError::HomeNotSet)
 }
 
 pub fn require_run_user() -> Result<String, SandboxError> {
-    env::var("XDG_RUNTIME_DIR")
+    std::env::var("XDG_RUNTIME_DIR")
         .ok()
         .or_else(resolve_run_user_from_proc)
         .ok_or(SandboxError::RunUserNotFound)