fix(terminal): stop leaking provider env to local subprocesses

[PeterFile]

What changed

This PR fixes terminal subprocess environment leakage for local execution.

Hermes currently loads provider credentials and endpoint overrides from
~/.hermes/.env into the parent process environment. Local terminal
subprocesses and local background processes then inherit that full
environment by default. As a result, unrelated external CLIs such as
Codex can be silently pointed at Hermes' custom provider endpoint.

This change adds a shared subprocess environment helper and uses it in
the local terminal execution paths so Hermes runtime provider variables
are removed before spawning child processes.

Updated code paths:

• tools/environments/base.py
• tools/environments/local.py
• tools/process_registry.py

Behavior after this change:

• Local foreground terminal commands no longer inherit Hermes provider
  env vars by default
• Local background processes no longer inherit Hermes provider env vars
  by default
• Explicit per-command env overrides still work, so callers can opt in
  when they intentionally need those variables

Why

This keeps the normal shell environment intact while preventing Hermes'
provider credentials and endpoint overrides from leaking across tool
boundaries into unrelated subprocesses.

It is a focused bug fix with a small surface area and avoids changing
provider resolution, config format, or terminal interfaces.

How to test

1. Set a custom endpoint in ~/.hermes/.env:

   OPENAI_BASE_URL=http://localhost:8000/v1
   OPENAI_API_KEY=dummy

2. Run Hermes with the local terminal backend.

3. From Hermes, run a child process that prints the variable:

   python -c 'import os; print(os.getenv("OPENAI_BASE_URL", ""))'

4. Confirm the child process prints an empty string by default.

5. Confirm explicit env injection still works for local subprocesses when
   intentionally provided by the caller.

6. Run the targeted regression tests:

   pytest -o addopts='' tests/tools/test_terminal_env_sanitization.py -q
   pytest -o addopts='' tests/tools/test_process_registry.py -q
   pytest -o addopts='' tests/tools/test_file_tools_live.py::TestLocalEnvironmentExecute -q

Platforms tested

• macOS

Related issues

Fixes #1002