Warn on CLAUDE_CODE_SUBPROCESS_ENV_SCRUB permission-mode downgrade - #511

Motivation

I run CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1 globally as recommended credential-scrubbing hardening, and it silently downgraded every spacedock claude dispatch to prompt-on-everything — the two compose badly, and nothing told me why until I went digging. Rather than route around Claude Code's own hardening by guessing an --allowedTools allowlist on the operator's behalf, spacedock should just tell you what's happening and point at the fix.

Summary

• spacedock claude now warns on stderr at launch when CLAUDE_CODE_SUBPROCESS_ENV_SCRUB is set and --allowedTools wasn't declared — fires on both the unsandboxed and --safehouse launch paths
• spacedock doctor --host claude prints the same advisory as an informational stdout note (never affects the exit code)
• Documented the interaction in the command reference
• Consolidated the env-var-scanning helper (hasEnv/envValueOf) instead of adding a third near-duplicate copy

Test plan

• go test ./internal/cli/... — new tests cover truthy/falsy parsing, both launch paths, both suppression cases, and doctor host-scoping
• go test ./... — no new failures (2 pre-existing, unrelated failures on this machine: TestCodexResolveManifestAgainstInstalledHost, TestSurveyCodexPresenceThroughSync)
• go test ./... -race — clean
• gofmt -l ./cmd ./internal — clean except a pre-existing unrelated file (internal/release/journeydelta.go, unformatted on main before this branch)

Closes #504