Subprocess calls now run with an isolated environment via extendEnv

What

• Calls to the gh CLI (for GH_TOKEN lookup and repo content fetches, and for gh repo list during auto-mode sibling-repo lookups) now build their environment from an explicit snapshot with extendEnv: false, instead of spreading the entire process.env into the subprocess.
• An extendEnv option was plumbed more generally into the shared exec-options builder and into other spawn call sites.

Why

This stops gh and other spawned subprocesses from inheriting the parent process's full environment, reducing the chance of leaking unrelated environment variables into these subprocess calls.