[codex] Centralize subprocess env boundaries (#585)

* Centralize subprocess env boundaries

* Remove env boundary static audit test

* Tighten env boundary process launches

* Fix Windows native process launches

* Inline provider env pass-throughs

packages/desktop/src/daemon/node-entrypoint-launcher.ts

@@ -1,6 +1,7 @@
 const IGNORED_ARG_PREFIXES = ["-psn_", "--no-sandbox"];
 
 export const DESKTOP_CLI_ENV = "PASEO_DESKTOP_CLI";
+const PASEO_NODE_ENV = "PASEO_NODE_ENV";
 
 export interface NodeEntrypointSpec {
   entryPath: string;
@@ -38,7 +39,7 @@ export function createElectronNodeEnv(
   return {
     ...baseEnv,
     ELECTRON_RUN_AS_NODE: "1",
-    ...(options?.isPackaged === true ? { NODE_ENV: "production" } : {}),
+    ...(options?.isPackaged === true ? { [PASEO_NODE_ENV]: "production" } : {}),
   };
 }