fix/batches: prevent executor environment leakage to steps

[cbrnrd]

Problem

Batch steps can request environment variables by name. The executor passed its full process environment into this resolver, so a step could request reserved SRC_EXECUTOR_* values. These values include executor control credentials that must not be available inside an ordinary batch step.

This fixes VULN-141.

Solution

Filter the reserved SRC_EXECUTOR_* namespace from the outer environment before resolving step variables. The filter is applied at the step execution boundary, so it covers every caller and also protects future variables in the reserved namespace. Normal environment variables and explicit step values continue to work.

Verification Evidence

• Added a regression test showing that normal outer variables still resolve.
• Added coverage showing that current and future SRC_EXECUTOR_* outer variables resolve to empty values.
• go test ./internal/batches/...
• go test ./cmd/src

[cbrnrd]

Merge activity

• Sep 9, 1:27 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• Sep 9, 1:28 PM UTC: Graphite rebased this pull request as part of a merge.
• Sep 9, 1:35 PM UTC: Graphite rebased this pull request as part of a merge.
• Sep 9, 1:42 PM UTC: @cbrnrd merged this pull request with Graphite.