Security patch for supervised child-process environment inheritance.

• Managed processes now use the existing child-environment allowlist instead of inheriting the full operator environment.
• Explicit environment overrides pass through the same credential-name filtering.
• Regression tests use synthetic canaries and verify captured child output; process-manager and sanitizer suites pass all 48 tests. Full PR CI and security review passed.

Upgrade from 0.28.0 and earlier, and restart existing engine processes to load the fix. This patch addresses automatic environment inheritance; it does not provide filesystem or same-user process isolation.

Thanks to Frank Kuhn (Swipergy GmbH) for reporting the issue. No CVE identifier has been assigned yet.

See PR #262 and the changelog.