Policy-helper subprocess environment scrubbing moved and hardened

The list of credential-bearing environment variables removed before running a policy helper (ANTHROPIC_API_KEY, AWS_SECRET_ACCESS_KEY, GOOGLE_APPLICATION_CREDENTIALS, and others matched by a TOKEN/SECRET/PASSWORD-style pattern) has moved out of its previous module into a dedicated one. The sanitizer built around it now also drops loader and interpreter hijack variables like LD_, DYLD_, NODE_OPTIONS, BASH_ENV, CLASSPATH, and OPENSSL_CONF, and pins PATH, COMSPEC, ZDOTDIR, XDG_CONFIG_HOME, and git config paths to an empty directory.