fix: harden path traversal, env injection, and tool security defenses - #77

Manifest env: entries are applied to the child process with no filtering.
A malicious manifest could override HOME, PATH, NODE_OPTIONS, etc. to
escape the sandbox. Block these with a warning until the install-time
elicitation flow is implemented.

Part of #59

- bridge: refuse to start when HOME is unset instead of falling back to
  world-writable /tmp
- plugins: expand blocked env var list with proxy vars, TMPDIR, TLS/CA
  cert overrides (NODE_EXTRA_CA_CERTS, SSL_CERT_*)
- hooks: prevent custom env from overriding sandboxed allowlist vars
  (PATH, HOME, etc.) in CommandHandler
- core: reject '..' path components in HOME and ASTRID_HOME in
  AstridHome::resolve()
- mcp: add env var blocklist for library/code injection vars in
  connect_stdio_server()

Part of #59

- hooks: add BLOCKED_HOOK_ENV list and is_blocked_hook_env() to prevent
  LD_PRELOAD, NODE_OPTIONS, BASH_ENV, OPENSSL_CONF, and LD_/DYLD_/
  npm_config_ prefix injection in sandboxed hooks
- hooks: extract apply_env() helper to satisfy clippy::too_many_lines
- mcp: align server blocklist with the plugin blocklist (add HOME, PATH,
  ASTRID_HOME, proxy vars, TLS/CA vars, TMPDIR, OPENSSL_CONF)
- plugins: add ASTRID_HOME, OPENSSL_CONF to blocklist; add LD_/DYLD_/
  npm_config_ prefix blocking
- core: fix test pollution — add EnvGuard RAII type so HOME is restored
  even on panic unwind

Part of #59

Addresses all findings from three parallel security/correctness/architecture
reviews of the home-path-traversal branch.

Critical fixes:
- Fix UTF-8 panic in read_file line truncation (char boundary check)
- Remove double spark onboarding call (main.rs + chat.rs)
- Wrap blocking flock in spark_tool with spawn_blocking
- Use EnvGuard RAII in all env-mutating tests (panic-safe cleanup)

Security hardening:
- Extract shared env_policy module in astrid-core with comprehensive
  blocklist (union of hooks/MCP/plugins lists + prefix matching)
- Replace all three inline blocklists with shared is_blocked_spawn_env()
- Validate HOME is absolute before use (matching ASTRID_HOME guard)
- Filter context env vars through blocklist in hook sandbox
- Validate HOME before relaying to hook child processes
- Enforce absolute paths in read_file, write_file, edit_file tools
- Fix JS bridge path separator for Windows (use path.sep)

Minor improvements:
- Add gateway SparkConfig field-parity test
- Add SparkLockGuard RAII with lock file cleanup on drop
- Sanitize spark before format_spark in evolve response
- Document spark preamble + custom prompt interaction

Also includes spark agent identity feature (onboarding, config, tool,
system prompt integration).

native-tls 0.2.17 has a non-exhaustive match bug on newer Rust toolchains. astrid-llm was overriding the workspace reqwest (which uses rustls-tls) with bare defaults that pulled in native-tls. teloxide also defaulted to native-tls. Switch both to use workspace deps with rustls, eliminating native-tls entirely.