fix(acpmux): pass machine environment literals to local agents
Cloud machines write environment declarations to ~/.config/cmux/machine.env, but acpmux's login environment only admits a fixed variable list and relies on shell startup hooks. A declared application variable can therefore be absent from the next agent.
Read the receiver's single-quoted export format directly at local child launch, without shell evaluation. The bounded reader accepts only private owned regular files, rejects loader/bootstrap names and malformed exports, and supports literal newlines and escaped quotes. Replacements and deletion take effect on the next local launch. Explicit profile/preset/session values retain precedence. Machine values stay outside generic login APIs, the disk cache, remote launches, and ${env:VAR} references. Only observed declaration names remain in memory, so deletion also clears a stale value inherited by the daemon. Old login caches are invalidated.
Request: "Take the machine.env allow-list there, or have a helper open it as its own small acpmux PR." Builds on #29292 and #27487; the delivered-secret path keeps its local-only authority. Prior-art's live search was unavailable through the broker quota; named merged changes and the shared partial open-PR cache were inspected, and an origin search was requested.
Validation: Rust formatting and diff checks pass. Fleet tests are dispatched after opening this PR (the broker requires an owned open PR). Added parser/file safety tests and an actual daemon/child canary covering delivery without a shell hook, rotation, revocation (including daemon-inherited old values), profile precedence, reference isolation, and no cached/logged values. Current candidate: 78da7b9cb14afcceb3c4ac0c7332cce994eae6f2; fleet parser/file-safety tests (3/3) and the full actual-daemon/child auth suite (28/28) pass: https://github.com/manaflow-ai/cmux/actions/runs/41288996539 . The receipt pins this head as the only parent of snapshot 98d20015f7f5e74ade5cb06a09efebba294232dd. Includes daemon-inherited env-reference refusal and current nested-Claude credential restoration, both covered by actual-child regression cases. Cross-model security review requested at that exact head.
Nonblocking independent-review follow-ups: #30544, #30545, #30546, #30547, #30548, #30549, #30551. Daemon-inherited revocation and env-reference bypass are fixed in this PR.
Risk: secret delivery and local/remote environment separation. No timers or background loops are added. Every local overlay read is bounded to 4 MiB, and values are never retained between launches.
Agent session: agent session