pub fn build_env(
policy: &EnvPolicy,
deny_env: &[String],
host: &HashMap<String, String>,
) -> HashMap<String, String>Expand description
Build the child env: start empty, copy allow-listed host vars, apply set,
then strip anything matching deny_env globs (deny wins, applied last).