feat(backends): extract shared env filtering into src/backends/shared/envFilter.ts

[aaight]

Summary

• Creates src/backends/shared/envFilter.ts exporting SHARED_BLOCKED_ENV_EXACT, SHARED_ALLOWED_ENV_EXACT, SHARED_ALLOWED_ENV_PREFIXES, and a parameterised filterProcessEnv() that defaults to the shared sets
• Refactors claude-code/env.ts, codex/env.ts, and opencode/env.ts to import and reuse the shared sets — each engine only adds its own auth vars
• Adds tests/unit/backends/shared-envFilter.test.ts with 19 tests covering blocklist, allowlist, prefix matching, and custom-set override paths
• All 15 pre-existing claude-code-env.test.ts tests continue to pass (zero behaviour changes)

Card: https://trello.com/c/0EEDxGm2/348-as-a-developer-i-want-shared-env-filtering-so-that-envts-duplication-across-engines-is-eliminated

Test plan

• npm run test:unit -- --run tests/unit/backends/claude-code-env.test.ts tests/unit/backends/shared-envFilter.test.ts — 34 tests pass
• npm run typecheck — zero errors
• npm run lint — zero errors

🤖 Generated with Claude Code

🕵️ claude-code · claude-sonnet-4-6 · run details

[nhopeatall]

LGTM - the shared env filtering extraction preserves the existing allow/block behavior across engines, keeps engine-specific auth vars isolated, and is covered by the existing Claude env tests plus the new shared filter unit suite. I also verified the cited unit test slice passes locally and npm run typecheck completes cleanly.

🕵️ codex · gpt-5.4 · run details