[Repo Assist] improve: use FrozenSet for ExecEnvSanitizer blocked-names lookup

[github-actions]

🤖 This is an automated PR from Repo Assist.

Summary

Upgrades _blockedNames in ExecEnvSanitizer from HashSet<string> to FrozenSet<string>.

What changed

// Before
private static readonly HashSet<string> _blockedNames = new(StringComparer.OrdinalIgnoreCase) { ... };

// After
private static readonly FrozenSet<string> _blockedNames =
    new HashSet<string>(StringComparer.OrdinalIgnoreCase) { ... }
    .ToFrozenSet(StringComparer.OrdinalIgnoreCase);

Why

_blockedNames is written once at class initialisation and never mutated. FrozenSet<T> is specifically designed for this pattern — it provides O(1) Contains with lower constant-factor overhead than HashSet because it stores no mutation infrastructure.

This matches the established pattern already used throughout the codebase:

Type	Location
FrozenSet<string>	ChannelHealth.s_healthyStatuses / s_intermediateStatuses (Models.cs)
FrozenDictionary<string, ...>	NotificationCategorizer.ChannelMap / IntentMap / CategoryTitles
FrozenDictionary<string, string>	ChannelHealth.s_statusLabels (Models.cs)

IsBlocked() is called on every environment-variable key that passes through system.run, making this a meaningful hot-path improvement.

Test Status

• dotnet build — succeeded, 0 errors, 0 warnings
• dotnet test OpenClaw.Shared.Tests — passed (exit 0)
• dotnet test OpenClaw.Tray.Tests — passed (exit 0)

Generated by 🌈 Repo Assist, see workflow run. Learn more.

Generated by 🌈 Repo Assist, see workflow run. Learn more.

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/repo-assist.md@97143ac59cb3a13ef2a77581f929f06719c7402a