Function sanitize_pty_command 

pub fn sanitize_pty_command(c: &mut CommandBuilder)

Apply the policy to a PTY command: strip inherited identity, then mark the child as running inside AgentMux.

Exists so a caller cannot apply half of it. The first version of this fix inlined the strip at ONE of shell/lifecycle.rs’s three CommandBuilder branches, leaving the direct-spawn path (agent CLIs launched with args) and the shell-wrapped cmd path fully leaking — caught in review as a P0. Call this once on the finished command instead.

Safe to call after the caller’s own .env() values: everything a pane legitimately sets is on PANE_ENV_KEEP, so nothing it just set is removed.