fix(runner): commit the env-policy file the split referenced

ee200bdf7 moved the child-environ allowlist to sandbox_env.zig but the new
file never entered the index — a pathspec commit takes tracked changes only,
so the branch head did not compile from a clean checkout and the policy that
keeps AGENTSFLEET_ credentials out of sandboxed children sat outside review.
Found by the security review pass. The scratch probe also creates its file
exclusively now: an existing file cannot stand in for MAKE_REG, and O_EXCL
refuses a planted symlink if the probe is ever hand-run unsandboxed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>