#994 Unsandboxed shell tasks inherit the full worker environment (DB_PASSWORD, keys, Vault token)

EARS SPEC: - When a shell or code task runs outside the sandbox, the engine shall pass it only an explicit allowlisted environment (PATH, LANG, HOME, the task's own declared environment, HW_V_* bindings), never the worker's secrets. CONTEXT: engine/tools/shell_command/template.py worker_environment() merges os.environ into the subprocess env (and before #972, subprocess inherited it by default). Unsandboxed shell is limited to platform-admin-listed tenants (D6), so this is a trusted-tenant path; the worker env still holds DB_PASSWORD, HIGHWAY_ENCRYPTION_KEY, RBAC_MASTER_ENCRYPTION_KEY, JWT secret, VAULT_TOKEN_ADMIN, so any unsandboxed task can read them with 'env'. Same class as #991. Found during #972 review.