fix(farm): scrub dispatcher secrets from the pluggable mutation hook env

[SUaDtL]

What

Closes a least-privilege gap in the farm dispatcher: the pluggable FARM_MUTATION_CMD mutation hook spawned with { ...process.env }, so an operator-wired (possibly third-party) mutation framework inherited FARM_API_KEY and CLAUDE_CODE_OAUTH_TOKEN. It was the one child-spawn path that bypassed run()'s existing secret scrub, against the intent stated in run()'s own comment.

The fix adds a single shared helper in exec.ts:

export function scrubbedEnv(extra?) {
  const env = { ...process.env, ...(extra ?? {}) };
  delete env.FARM_API_KEY;
  delete env.CLAUDE_CODE_OAUTH_TOKEN;   // deleted LAST, after the merge
  return env;
}

Both run() and the mutation-hook spawn now route through it, so there is one scrub, not two that can drift. The hook still receives the FARM_MUTATION_* contract vars; only the credentials are stripped.

Why

This is the same least-privilege control run() already applied to git, gate, setup, and test commands (CodeQL #5). The mutation hook runs operator-supplied code in the worktree and has no need for the dispatcher's API key. Deleting the secrets after merging extra means a caller var can never re-introduce one.

Surfaced by auth-crypto-reviewer during the #140 (v2.rev.0020) review as a pre-existing gap, not introduced by that refactor. Conflict-hierarchy: a level-1 (security) tightening with no behavior change to any non-secret path.

Test plan

• New subprocess integration test (farm.test.ts): the hook runs a committed probe that records its own env; the test asserts FARM_API_KEY / CLAUDE_CODE_OAUTH_TOKEN read ABSENT while FARM_MUTATION_FILES/TEST_PATH/TEST_CMD are present. Fails on the pre-fix code (the secret leaks), passes after.
• New unit test (farm.unit.test.ts): pins the delete-last ordering by passing a secret in extra and asserting it is stripped, so a future reorder cannot silently break the defense.
• Existing run() scrub test still green (now exercises the shared helper).
• npx vitest run: 171/171. npx tsc --noEmit: clean. farm.js rebuilt and deterministic.

Reviews

All three path-matrix reviewers PASS, no CRITICAL or HIGH:

• auth-crypto-reviewer: scrubbedEnv() removes both secrets after the merge; run() behavior identical; no real secret, TLS downgrade, or banned primitive.
• security-reviewer: tightens the secret-store control; SHELL_OPTS cannot override the scrubbed env; the two sk-/tok- shaped values are fake test sentinels matching the sanctioned dummy-value convention.
• coverage-auditor: about 85 percent, both scrubbedEnv paths exercised, both obligations verified. Its one LOW (untested delete-last ordering) is closed by the unit test in this PR.

Note on the commit gate

The compound-name secret detection from v2.rev.0016 (shipping in 2.6.0) flags the test's FARM_API_KEY:/CLAUDE_CODE_OAUTH_TOKEN: fixture lines. The secret-handling gate reviewed them (fake sentinels) and recorded a diff-bound pass before commit. The currently installed plugin (2.5.2) predates that detection, so its local hook does not flag them, which is expected release lag, not a gap.

Ref: v2.rev.0020 follow-up (auth-crypto-reviewer finding)