Scrubbed environment for tool subprocesses.

Tools that spawn OS processes (bash, ripgrep in file_grep) must not inherit the BEAM's environment: it routinely holds API keys, OAuth tokens, and vault credentials, and an LLM is one printenv away from leaking them. Shell-loader hooks (LD_PRELOAD, DYLD_INSERT_LIBRARIES) are dropped for the same reason.

Every subprocess-spawning tool must use scrubbed/0 so the allowlist has exactly one definition.