fix(tools): preserve env overrides and cwd across macOS sandbox rewrite

[bug-ops]

Summary

• rewrite_command_with_sandbox_exec on macOS replaced the entire std::process::Command with Command::new(sandbox_exec) to prepend the sandbox wrapper. Only program + args were carried over; .env / .env_remove overrides and .current_dir were dropped on the floor.
• Concrete impact, post-fix(tools): forward set_skill_env and set_effective_trust through CompositeExecutor #3870:
  • Skill secret env injection broken under sandbox: with [tools.sandbox] enabled = true (the default in production configs), cmd.envs(extra_env) set by build_bash_command was wiped before spawn. GITHUB_TOKEN injected for the github skill never reached gh; tool reported Token in default: invalid because gh fell back to hosts.yml (which has no oauth_token field).
  • Caller-configured current_dir discarded: any future / present .current_dir(...) on bash invocations was reset to the parent process cwd.
• Capture program + args + envs + cwd before the in-place replacement, then replay envs and cwd onto the new Command. Added one regression test (rewrite_preserves_env_overrides_and_cwd) that sets .env, .env_remove, and .current_dir and asserts all three survive the rewrite.

Closes #3871. Restores the end-to-end flow originally targeted by #3870 (which fixed the propagation through CompositeExecutor but left the sandbox-side defect in place).

Test plan

• cargo +nightly fmt --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo nextest run -p zeph-tools -E 'test(sandbox)' → 58 passed (incl. new regression)
• cargo nextest run --workspace --lib --bins → 9323 passed
• Manual macOS verification: with [tools.sandbox] enabled = true, ZEPH_SECRET_GITHUB_TOKEN in age vault, github skill trusted with x-requires-secrets: github_token, ask agent to run gh auth status and confirm source is (GH_TOKEN)/(GITHUB_TOKEN) (not (default)).

Notes

• Linux Landlock backend does not use Command replacement (LSM ruleset attaches in-process), so this defect is macOS-specific. No change to linux.rs.
• The wider design issue — skill secret env should reach the subprocess regardless of sandbox state — is now resolved end-to-end. Trust-gate forwarding (fix(tools): forward set_skill_env and set_effective_trust through CompositeExecutor #3870) and env preservation (this PR) together close the chain vault → available_custom_secrets → set_skill_env → ShellExecutor::skill_env → cmd.envs → sandbox-exec → bash.