bash: image_env() util + subprocess.run env parity (drop clean_env flag)

[Meirtz]

Why (maintainer review of #151)

A boolean clean_env flag on run/run_stream adds cognitive cost to a tool that should read exactly like subprocess.run — and the mechanism to choose an environment already exists: you pass env=. The right shape is a util you pass as a value, not a mode that forks behavior.

What

• env= now follows subprocess.run exactly: omit it to inherit the worker's environment (right for bundle tools — the claude CLI, bundled rg); pass a dict to replace it wholesale. No merge, no flag. (No production caller passed a partial env expecting a merge; tests updated to the replace idiom.)
• image_env() is the extracted helper the swebench scorer hand-rolled: get_env_without_agentix() plus BASH_ENV → ~/.bashrc — derived from the result env's HOME, so a stripped-and-restored or overridden HOME picks the right rc file. Canonical name agentix.bash.image_env, re-exported next to run(); implemented in agentix.runtime.shared.env because that module owns the ADDED/SAVED contract and a cross-plugin import doesn't resolve statically in the pkgutil-namespace layout (pyright). score.py now calls it instead of its private copy.
• The shell binary follows the env's PATH like everything else the command resolves: the default worker env lists the bundled bash first (bundle behavior unchanged), while an image_env() PATH selects the image's own bash — its restored LD_PRELOAD targets that binary, not the Nix one. Value-driven, no mode.

Boundary

image_env() reads the calling process's live environment — only meaningful inside the sandbox. Sandbox-side code composes directly (run(cmd, env=image_env())); a host fetches it over the wire (env = await c.remote(image_env)). The docs warn that evaluating it host-side would ship the host's environment (PATH/HOME/secrets) into the container — the co-author review caught that the first draft's doc example had exactly this footgun.

Dual-reviewed (Codex + adversarial pass); all three confirmed findings fixed: host-side-evaluation footgun in the docs, shell selection dropped in the redesign (now PATH-driven), HOME-override picking the wrong .bashrc.

🤖 Generated with Claude Code