Forward locale variables into the Duo Workflow sandbox

What does this MR do and why?

Remote Duo Agent Platform sessions run with a POSIX locale, even when the image sets a UTF-8 one. Tools then treat text as US-ASCII. For example, Ruby fails with invalid multibyte char (US-ASCII), and agents waste turns retrying with export LANG=C.UTF-8.

The cause is how the job script starts the executor: env -i <allowlist> srt ... (or env -i ... nono run ...). LANG and LC_ALL were not in the allowlist, so they were stripped.

This MR adds LANG and LC_ALL to FORWARDED_ENV_VARS. Like the existing proxy variables, they are forwarded only when set. Images that don't set a locale behave exactly as before. The change applies to both the SRT and nono paths. The troubleshooting docs list of forwarded variables is updated to match.

Out of scope: the default DAP image (workflow-generic-image) sets no locale, will be follow up change in https://gitlab.com/gitlab-org/duo-workflow/default-docker-image

References

• Resolves https://gitlab.com/gitlab-org/gitlab/-/work_items/632895

Screenshots or screen recordings

Both runs were on a local GDK, using the default DAP image plus ENV LANG=C.UTF-8 LC_ALL=C.UTF-8, which mirrors gitlab-build-images. The agent was asked to run locale and some Ruby encoding checks, and to report the output verbatim.

Before	After

How to set up and validate locally

1. In a GDK project with remote flows enabled, build an image that selects a UTF-8 locale:

   FROM registry.gitlab.com/gitlab-org/duo-workflow/default-docker-image/workflow-generic-image:latest
   ENV LANG=C.UTF-8 LC_ALL=C.UTF-8

   docker build -t duo-locale-demo:latest .

2. Set image: duo-locale-demo:latest in the project's .gitlab/duo/agent-config.yml. The GDK runner uses pull_policy = if-not-present, so the local tag is picked up.

3. Start a Developer flow with a goal such as: run echo "LANG=[$LANG]"; ruby -e 'p Encoding.default_external' and report the output verbatim.

4. On master, the output is LANG=[] and #<Encoding:US-ASCII>. On this branch, it is LANG=[C.UTF-8] and #<Encoding:UTF-8>. In the job log, the env -i line now contains ${LANG+LANG="$LANG"}.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.