[BUG] LD_LIBRARY_PATH leaks bundled shared libs into git subprocesses, breaking shared-clone materialization

[pngdeity]

Describe the bug
PyInstaller bootloader sets LD_LIBRARY_PATH=/usr/lib/apm/_internal so the bundled Python can find libpython3.12.so. This leaks into every subprocess.run() call, including materialize_from_bare() in bare_cache.py. Bundled shared libs (libreadline.so.8, libz.so.1, libsqlite3.so.0, etc.) shadow system libraries, breaking /bin/sh:

/bin/sh: symbol lookup error: /bin/sh: undefined symbol: rl_print_keybinding
fatal: Could not read from remote repository.

This causes git clone --local --shared --no-checkout to exit 128 in the shared clone cache path. The resulting user-facing error is:

Failed to prepare dependency from cached clone: Command git clone --local --shared --no-checkout ... returned non-zero exit status 128.

To Reproduce

1. Install APM v0.16.0 binary on an Arch Linux system
2. Create an apm.yml with 2+ virtual subdirectory deps from the same repo:

   dependencies:
     apm:
       - owner/repo/packages/pkg-a#tag
       - owner/repo/packages/pkg-b#tag

3. Run apm install
4. All deps fail with exit 128

Confirm the root cause manually:

LD_LIBRARY_PATH=/usr/lib/apm/_internal git clone --local --shared --no-checkout <bare> <dest>
# /bin/sh: symbol lookup error: ... / exit 128

Expected behavior
Virtual subdirectory dependencies from the same repo install successfully on first run.

Environment

• OS: Arch Linux (rolling, linux 7.0.10)
• APM Version: 0.16.0 (e94af4a)
• Git Version: 2.54.0

Root Cause
Two gaps in the LD_LIBRARY_PATH sanitization:

1. git_subprocess_env() in git_env.py copies os.environ but does not strip LD_LIBRARY_PATH. This sanitizer exists precisely to clean ambient variables from git subprocess environments — LD_LIBRARY_PATH leaking is a sanitization failure.

2. build/apm.spec excludes only libssl.so.3/libcrypto.so.3 from the bundle (fix for [BUG] Fedora: brew apm fails on Git clone due to bundled OpenSSL mismatch #462). Other bundled shared libs (libreadline.so.8, libz.so.1, liblzma.so.5, libsqlite3.so.0, libffi.so.8, libbz2.so.1.0, libuuid.so.1, libtinfo.so.6) also leak into child processes.

Additional context
Same class of bug as #462 (OpenSSL LD_LIBRARY_PATH leak), but broader — affects any non-Python shared library bundled by PyInstaller that differs from the system version.