Function contract_command_env 

pub fn contract_command_env(
    mission_scratch: &Path,
    base_sha: Option<&str>,
    passthrough: &[String],
) -> HashMap<String, String>

The cleared env for one contract/gate command execution (validation round, final gate, approval-time lint — design decision 3 of the ticket): sanitized_child_env over the per-mission writable mission_scratch home, plus

• KRANZ_BASE_SHA via the shared crate::runner::contract_env idiom,
• a cache-only CARGO_HOME plus the non-credential toolchain locations,
• exactly the ambient vars NAMED in passthrough (the mission config’s contractEnvPassthrough escape hatch — the sanctioned way to give a contract one credential). Names only are logged, never values; a passthrough name colliding with a managed key (PATH/HOME/…) is refused with a warning so the hatch cannot reopen the boundary it sits on.