fix(sync): adopt upstream cron-script env sanitization (SECURITY.md §2.3)

Post-merge fix for the cron/scheduler.py env conflict. Upstream hardened
no_agent cron-script subprocess env to strip provider secrets via
_sanitize_subprocess_env (_HERMES_PROVIDER_ENV_BLOCKLIST). Resolution:
- Pass our profile-built run_env (HERMES_HOME, profile HOME, non-provider
  .env config) THROUGH _sanitize_subprocess_env — keeps our profile setup
  AND satisfies upstream's test_script_subprocess_env_sanitized.
- Verified zero blast radius: our only no_agent scripts (evolution_watchdog,
  evolution_funnel) do not read provider keys from env.
- Adapt our test_script_reads_env_from_hermes_dotenv to assert NON-provider
  .env config still reaches scripts (provider-secret stripping is covered by
  upstream's test).

Author: Lexus2016

cron/scheduler.py

@@ -1086,6 +1086,11 @@ def _run_job_script(script_path: str) -> tuple[bool, str]:
             text=True,
             timeout=script_timeout,
             cwd=str(path.parent),
+            # Start from our profile-built run_env (HERMES_HOME, profile HOME,
+            # non-provider .env config) then strip provider secrets per upstream
+            # SECURITY.md §2.3: cron scripts must NOT inherit Hermes provider env
+            # (anti-exfiltration). Our no_agent scripts (evolution_watchdog/funnel)
+            # don't read provider keys from env, so this is safe.
             env=_sanitize_subprocess_env(run_env),
             **popen_kwargs,
         )

tests/cron/test_cron_script.py

@@ -198,21 +198,26 @@ def test_script_json_output(self, cron_env):
         assert parsed["new_prs"][0]["number"] == 42
 
     def test_script_reads_env_from_hermes_dotenv(self, cron_env):
-        """no_agent scripts should inherit API keys from HERMES_HOME/.env."""
+        """no_agent scripts inherit NON-provider config from HERMES_HOME/.env.
+
+        Provider secrets (OPENROUTER_API_KEY, etc.) are stripped per upstream
+        SECURITY.md §2.3 — see test_script_subprocess_env_sanitized. Non-secret
+        config from .env still reaches the script.
+        """
         from cron.scheduler import _run_job_script
 
         env_file = cron_env / ".env"
-        env_file.write_text("OPENROUTER_API_KEY=sk-test-123\n")
+        env_file.write_text("EVOLUTION_PIPELINE_REGION=eu-west\n")
 
         script = cron_env / "scripts" / "read_env.py"
         script.write_text(textwrap.dedent("""\
             import os
-            print(os.getenv("OPENROUTER_API_KEY", "MISSING"))
+            print(os.getenv("EVOLUTION_PIPELINE_REGION", "MISSING"))
         """))
 
         success, output = _run_job_script("read_env.py")
         assert success is True
-        assert output == "sk-test-123"
+        assert output == "eu-west"
 
 
 class TestBuildJobPromptWithScript: