Refuse env dumps in raw-command recipes

just lab env-names is the sanctioned way to list container env, but just lab ssh-cmd still ran any string, so printenv could put a signing key in its context.

A guard now runs before ssh and exits 2, naming just lab env-names, on dump shapes: printenv, a bare env, an inspect without a State or Image format, /proc/*/environ, systemctl show Environment, kubectl get secret -o yaml|json, kubectl exec ... env, a whole cat of gitlab-secrets.json or gitlab.rb. Near misses like env FOO=1 cmd pass. It covers ssh-cmd, ssh and the OpenShift Local helper. It is not a sandbox and has no override.

env-lint and the guard share scripts/env-patterns.sh.

flowchart LR
  A[typed command] --> B{env guard}
  B -- dumps env --> C[refused, exit 2]
  B -- otherwise --> D[vm_ssh]