feat(shell): scrub ambient credentials from child process environment (#618)

[cagdasyurekli]

Summary

This PR addresses and closes #618 by preventing ambient cloud credentials and secret tokens from automatically leaking into run_shell child processes.

Motivation

Currently, LocalExecutor inherits the entire os.environ from the parent process. If a developer launches OpenWorker in a terminal session where personal or cloud credentials are exported (AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, *_API_KEY, etc.), any shell command executed by the agent (or a build script invoked in the workspace) inherits ambient access to those secrets.

Proposed Solution & Changes

1. Ambient Credential Scrubbing (coworker/tools/shell.py):
   • Introduced filter_ambient_env and is_sensitive_env to identify and scrub sensitive environment variable patterns (AWS_*, AZURE_*, *_API_KEY, *_SECRET_*, *_TOKEN, *_PASSWORD, *_CREDENTIAL, etc.) by default.
   • Retains essential system variables (PATH, HOME, USER, SHELL, TERM, LANG, TMPDIR, virtualenv variables, etc.).
   • Explicit env={...} passed to LocalExecutor takes precedence as an explicit user override.
2. Configurable Allowlist (coworker/config.py):
   • Added shell_allowed_env field to Config supporting both [shell] allowed_env = [...] and shell_allowed_env = [...] in config.toml.
   • Hardened security model: workspace-level allowed_env is only applied if the workspace is explicitly trusted.
3. Agent Integration (coworker/agent.py):
   • Passed allowed_env=config.shell_allowed_env to LocalExecutor when instantiating the workspace executor.
4. Automated Tests (tests/test_shell.py, tests/test_config.py):
   • Unit tests covering pattern matching, ambient scrubbing, allowlist exemptions, explicit argument precedence, and configuration loading.

Verification

• Ran pytest tests/test_shell.py tests/test_config.py -v: 25 passed in 3.97s.
• Tested on macOS and clean python compilation.

Closes #618