Warn on CLAUDE_CODE_SUBPROCESS_ENV_SCRUB permission-mode downgrade

[jesserobbins]

Motivation

I run CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1 globally as recommended credential-scrubbing hardening, and it silently downgraded every spacedock claude dispatch to prompt-on-everything — the two compose badly, and nothing told me why until I went digging. Rather than route around Claude Code's own hardening by guessing an --allowedTools allowlist on the operator's behalf, spacedock should just tell you what's happening and point at the fix.

Summary

• spacedock claude now warns on stderr at launch when CLAUDE_CODE_SUBPROCESS_ENV_SCRUB is set and --allowedTools wasn't declared — fires on both the unsandboxed and --safehouse launch paths
• spacedock doctor --host claude prints the same advisory as an informational stdout note (never affects the exit code)
• Documented the interaction in the command reference
• Consolidated the env-var-scanning helper (hasEnv/envValueOf) instead of adding a third near-duplicate copy

Test plan

• go test ./internal/cli/... — new tests cover truthy/falsy parsing, both launch paths, both suppression cases, and doctor host-scoping
• go test ./... — no new failures (2 pre-existing, unrelated failures on this machine: TestCodexResolveManifestAgainstInstalledHost, TestSurveyCodexPresenceThroughSync)
• go test ./... -race — clean
• gofmt -l ./cmd ./internal — clean except a pre-existing unrelated file (internal/release/journeydelta.go, unformatted on main before this branch)

Closes #504

[jesserobbins]

I think this is ready now @clkao

[jesserobbins]

@clkao it felt like a lot of touches for a single environment variable. As you can see this is mostly just tests and documentation which is probably too verbose but seems to follow the project. Let me know if you want different issue. I ran this through my custom roborev loop across claude, codex, and pi.