fix(code): preserve required environment variables in native sandbox #127

The native sandbox builds an SRT credentials.envVars.deny list from every inherited environment name outside a small allowlist. This can unset required process variables such as HTTP_PROXY/HTTPS_PROXY (breaking the configured domain proxy path) and Windows runtime variables including SYSTEMROOT, TEMP, and COMSPEC.

Source: #101, packages/code/src/native-sandbox.ts (safeEnvironmentNames and the SRT credentials deny list).

Please preserve the minimum platform/runtime and configured proxy variables while continuing to deny unrelated inherited credentials, with focused tests.