feat(agent): add [config_env] for non-sensitive agent environment

[radim10]

Summary

Agent profiles can now set plaintext, non-sensitive config for the sandboxed agent with a [config_env] table. Before this, the Docker backend had no way to set any variables (the container starts with an empty environment), and the native backend only had whatever happened to be in the user's shell.

[config_env]
NODE_ENV = "development"
PORT = 3000
BUILD_HASH = { value = "9f86d081…", not_secret = true }

• Values can be strings, numbers or booleans; the agent always receives a string.
• --config-env NAME=VALUE on agent run sets or overrides a value for one run.
• Profile values take precedence over the inherited shell env; anything the sandbox sets always wins.

Guardrails

• Reserved names are rejected: proxy and CA vars, HOME, TMPDIR, FORCE_COLOR, STASHBASE_*, and PATH / LD_* / DYLD_*. The last group matters: [config_env] is applied to the native launcher (bwrap, systemd-run) before confinement, and the launcher is found through the child's PATH, so a repository profile could otherwise run its own code outside the sandbox. Reserved names are also skipped when building the child env, as a backstop.
• No shadowing bindings: a name a [secrets] / [personal_credentials] binding provides (its env, or a renamed from) is rejected, case-insensitively.
• Size limits: 64 KiB per NAME=value, 256 KiB total; NUL bytes rejected.
• Credential check: values that look like credentials (credential-like name, known token prefix, URL with a password, high-entropy string) warn in agent validate; agent run asks for confirmation and fails when it can't ask (non-interactive or --silent). Applies to --config-env values too. not_secret = true acknowledges a false positive. Values are never printed, and agent profiles show displays flagged values as <hidden: looks like a credential>.
• Audit: the session_started event records config_env_names (names only).

Also: a commented [config_env] example in the agent init template, docs in docs/agent-profiles.md, a short README section, and an example profile at docs/agent-profiles/examples/config-env.toml.

Testing

• cargo test: all pass (615 unit + integration suites), with new tests for detection, validation (reserved/invalid/conflicting names, limits, NUL), value parsing, the flag parser, env merging, audit field, masking and the init template.
• Manual, native backend on macOS: validate warnings, non-interactive fail-closed, not_secret acknowledgement, values reaching the agent, HTTPS_PROXY not overridable, PATH/LD_PRELOAD rejected, --config-env (incl. values containing =), audit event contents, masked profiles show (TOML and JSON).