Function fenced_command 

pub fn fenced_command(program: impl AsRef<OsStr>, scratch: &Path) -> Command

Build a command with no inherited environment except the allowlisted PATH, locale, timezone, user-name, and backtrace variables. Inherited API keys, tokens, and module identity variables are removed; HOME, XDG directories, and TMPDIR instead point beneath scratch. A ck-* program is copied to a reusable ckdev-* executable before the command is constructed. Use crate::TestDaemonCommand when roots must also resist later overrides and the child must terminate with the test harness.