pub const CONTAINER_ENV_DENYLIST: &[&str];Expand description
Env var names that reference host-filesystem paths and must NOT be forwarded
into a container via docker exec -e. The container image supplies its own
values for these (e.g. CLAUDE_CONFIG_DIR=/home/agent/.claude baked in).
CLAUDE_CONFIG_DIR being here is why a bound account’s credentials cannot
reach the container as an env var, and therefore why they are MOUNTED
instead — see ContainerMountSpec::claude_config_host_dir.