feat(runner): capture sanitized host state

[Windsor Nguyễn (windsornguyen)]

Summary

This change adds a Linux runner probe that records an allowlisted environment, process identity, kernel, cgroup, package, path, tool, and hosted-tool-cache inventory.

Evidence

• The test fixture defines a sentinel secret environment variable.
• The serialized probe omits the sentinel value and retains only the declared GitHub runner variables.
• The probe does not traverse arbitrary environment variables, process environments, home directories, cloud metadata, or GitHub temporary files.

Tests

• npm run lint.
• npm run typecheck.
• npm test.
• npm run build.
• npm run package.
• npm audit --audit-level=high.
• npm audit signatures.

Compatibility

This change adds a public API. The probe supports Linux and reports an error on another operating system.

Review focus

Review the environment and filesystem allowlists, deterministic ordering, error handling, and serialized schema.

[cind-bot]

Here's a flower for all your hard work! 🌸