swarm-review-classifier: claude's environment is an allowlist, not the daemon's

hive-claude adds its variables on top of the parent's environment, so
claude inherited the daemon's store identity paths, CREDENTIALS_DIRECTORY
and queue coordinates. claude now starts as this same binary with
SWARM_REVIEW_CLASSIFIER_EXEC_CLAUDE naming the real one; main execs it
before the runtime starts, with the environment cleared down to the API
key, PATH, HOME, CLAUDE_CONFIG_DIR and claude's telemetry settings. The
exec keeps the pid, so hive-claude's cancel and idle timeout still reach
it. An integration test runs the built binary as the trampoline and
checks that a BAO_* variable does not reach the program it execs.

swarm-review-classifier/tests/child_env.rs

@@ -0,0 +1,22 @@
+//! The trampoline through the real binary: a variable of the daemon's
+//! environment does not reach the program it execs, the API key does.
+
+use std::process::Command;
+
+#[test]
+fn the_daemons_store_identity_does_not_reach_claude() {
+    let out = Command::new(env!("CARGO_BIN_EXE_swarm-review-classifier"))
+        // Stands in for `claude`: prints what it was handed.
+        .env("SWARM_REVIEW_CLASSIFIER_EXEC_CLAUDE", "/bin/sh")
+        .env("BAO_CLIENT_KEY", "/run/credentials/x/review-classifier-bao-key")
+        .env("SWARM_REVIEW_CLASSIFIER_NATS_URL", "tls://nats.example:4222")
+        .env("ANTHROPIC_API_KEY", "k")
+        .args([
+            "-c",
+            r#"printf '%s|%s|%s' "${BAO_CLIENT_KEY-unset}" "${SWARM_REVIEW_CLASSIFIER_NATS_URL-unset}" "${ANTHROPIC_API_KEY-unset}""#,
+        ])
+        .output()
+        .expect("the binary runs");
+    assert!(out.status.success(), "{out:?}");
+    assert_eq!(String::from_utf8_lossy(&out.stdout), "unset|unset|k");
+}