fix: forward TMPDIR to sandbox subprocess to honor non-default temp dirs

[a7i]

Summary

• Forward the TMPDIR environment variable to the sandbox subprocess when it differs from the default /tmp, so that os.TempDir() resolves consistently between parent and child processes
• When the sandbox subprocess is created in createSandboxProcess(), the environment is cleared for security. This causes os.TempDir() in the child (used by setUpChroot()) to always return /tmp, even when the host uses a different temp directory (e.g. TMPDIR=/realtmp with /tmp as a symlink). The chroot setup then fails because SafeMount detects the path mismatch
• Add extensive tests verifying TMPDIR forwarding logic, subprocess behavior, and end-to-end round-trip correctness

Fixes #12476

Test plan

• Unit tests for env construction logic with various TMPDIR values (TestSandboxEnvTMPDIRForwarding)
• Subprocess tests verifying child process sees correct os.TempDir() (TestSandboxSubprocessTMPDIR)
• End-to-end tests mirroring createSandboxProcess env construction and verifying subprocess behavior (TestSandboxEnvEndToEnd)
• Verify no unintended env vars are leaked to the sandbox (TestSandboxEnvNoUnintendedLeaks)
• Verify env slice size matches expectations (TestSandboxEnvTMPDIROnlyEntry)
• Manual verification on a system where /tmp is a symlink to confirm the fix resolves the issue

Risk: Low

This change only adds a single environment variable (TMPDIR) to the sandbox subprocess when it differs from the default /tmp. It does not leak any sensitive information and preserves the security posture of the cleared environment.