mcpl child env allowlist: add REQUESTS_CA_BUNDLE/CURL_CA_BUNDLE and proxy vars #191

Follow-up to #175 (unreleased as of 0.19.0).

CHILD_ENV_ALLOWLIST lets NODE_EXTRA_CA_CERTS, SSL_CERT_FILE and SSL_CERT_DIR through, but not the equivalents for other stacks, and no proxy variables:

• REQUESTS_CA_BUNDLE / CURL_CA_BUNDLE. Python requests ignores SSL_CERT_FILE and uses certifi unless one of these is set. A container that trusts an internal CA with REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt (a common pattern next to NODE_EXTRA_CA_CERTS) will, after fix(mcpl): scrub host env from stdio MCPL children #175, give Python MCP servers TLS verify failures against internal hosts. Node servers keep working.
• HTTP_PROXY / HTTPS_PROXY / NO_PROXY (and the lowercase forms). A host behind an egress proxy loses network access in every child, including npx -y fetching the server package.

Both are operating config, not secrets, and fit the list's stated purpose ("just enough for an ordinary process to run"). Suggested direction: add them to the allowlist. Proxy URLs can carry user:pass@, but they leaked before #175 too and are the host's own egress.

Scope note, not a bug in the change. The scrub stops accidental leakage: servers that log or dump their env, and libraries that pick up *_API_KEY or mode flags from the environment. It does not stop a hostile child. A same-uid child can still read the host's full environment from /proc/$PPID/environ; this was verified with kernel.yama.ptrace_scope=1. It may be worth saying so in the changelog or inheritEnv docs, so operators don't read it as isolation.

🤖 Generated with Claude Code