fix(security): run builtin:bash with a sanitized, minimal environment (#81)

builtin:bash spawned /bin/bash inheriting the full gateway process
environment. Scrub it to a minimal default-deny allowlist (PATH, locale,
TERM, TZ) and pin HOME/TMPDIR/PWD to the per-session working directory
so commands only see a small, well-known set of variables.

- Extend the bash denylist to block /proc/<pid>/{environ,cmdline,mem}
reads as defense-in-depth.

- Add regression tests and update the README built-in tools notes.