Prevent runner startup from loading project configuration

[cedrecode]

Closes #25

What changed

• Start the shipped runner through a POSIX shell boundary before Bun can read project-controlled configuration.
• Disable automatic .env loading, ignore the working directory's bunfig.toml, and remove inherited BUN_OPTIONS and NODE_OPTIONS before trusted TypeScript starts.
• Preserve the existing wrapper-entry deadline and signal semantics in a dedicated TypeScript entry point.
• Add a boundary regression test covering .env, Bun preload execution, inherited startup options, ordinary inherited environment variables, and the shipped executable.

Verification

• Bun tests, strict typecheck, static invariants, and plugin validation pass.
• The exact candidate is installed in every affected harness.
• The changed behavior passes from each real user surface.
• The installed version, action, and observed result appear below.

Live evidence:

• Candidate: fe2537fff55dbc3ef8e276678cc9d682cd44b93e, Open Pstack 1.2.0, Bun 1.4.0.
• Automated: 156 tests and 639 assertions pass; strict TypeScript, static invariants, both strict Claude manifest validations, sh -n, and git diff --check pass.
• Adversarial review: a security/code reviewer first found project bunfig.toml, BUN_OPTIONS, and NODE_OPTIONS bypasses in the initial fix. After the shell-boundary revision, the reviewer reported no findings, residual risks, or test gaps.
• Codex: pstack@open-pstack installed and enabled from the exact checkout. From a fixture containing hostile .env, bunfig.toml preload, BUN_OPTIONS, and NODE_OPTIONS, the real subscription-backed Codex lane completed with PSTACK_LIVE_OK; the preload marker remained absent.
• Claude Code: pstack@open-pstack installed and enabled from the same checkout. The real Claude preflight authenticated, reached the subscription-backed API, and the hostile preload marker remained absent, proving the changed startup boundary. The subsequent model completion stopped on an unrelated account-level HTTP 429 (out of usage credits); the successful Codex lane above verifies end-to-end completion through the same shared runner.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[devtechdigital]

@Mergifyio queue

[mergify]

queue

☑️ Command disallowed due to command restrictions in the Mergify configuration.

Details

• sender-permission >= write

[devtechdigital]

@ericlitman CI is still awaiting maintainer approval: https://github.com/ericlitman/open-pstack/actions/runs/33003113377

Mergify has accepted the queue command, so approving that workflow run is the remaining blocker.