security: isolate release subprocess credentials (#333)

docs/release-engine-spec.md

@@ -15,6 +15,7 @@ Convert one eligible Gitea issue into a tested, traceable pull request without d
 - Coding-agent command, parsed into an argument vector.
 - Test command, parsed into an argument vector.
 - Positive, independent coding-agent and test deadlines plus a termination grace period.
+- Optional explicit allowlist of non-secret parent environment variables needed by the coding-agent runtime.
 - Local repository path and durable state-file path.
 
 ## State machine
@@ -54,6 +55,8 @@ repeating or advancing delivery.
 - Branch format: `<agent>/<issue>-<slug>`.
 - Coding and test commands are parsed with POSIX argument quoting and executed directly without a shell.
 - Issue number, title, body, repo, and branch are supplied to the coding agent only through `RELEASE_ISSUE_NUMBER`, `RELEASE_ISSUE_TITLE`, `RELEASE_ISSUE_BODY`, `RELEASE_REPO`, and `RELEASE_BRANCH` environment variables. Gitea-controlled content is never interpolated into executable syntax.
+- Child processes never inherit the complete parent environment. Coding receives a minimal runtime environment, explicitly allowlisted non-secret agent variables, and the five issue-context values. Tests and Git receive only the minimal runtime environment; `GITEA_TOKEN` remains parent-process-only.
+- Agent variables are allowlisted with repeated `--agent-env NAME` options or comma-separated `RELEASE_AGENT_ENV`. `GITEA_TOKEN`, `RELEASE_*`, and malformed names fail validation before claim.
 - Shell operators, substitutions, and pipelines are not interpreted. Operators that are intentionally required must live in a separately reviewed wrapper script configured as the command.
 - Empty or malformed commands abort before the issue claim.
 - Non-zero coding-agent exit blocks tests and PR creation.
@@ -96,3 +99,5 @@ repeating or advancing delivery.
 12. Restarts from `agent_complete`, `tests_passed`, and `pushed` skip only the
     completed stages and open exactly one linked PR.
 13. Dirty or identity-mismatched checkpoints stop before push or PR creation.
+14. Parent credentials are absent from coding-agent, test, and Git subprocesses while explicit agent variables and issue context reach only the coding stage.
+15. Reserved or malformed agent environment allowlist entries abort before claim.