workflow: spawn the worker with an empty environment

The documented vm escape reaches process, and the worker inherited the
harness's env - so a buggy or prompt-injected script could read and
exfiltrate ambient credentials (DEEPSEEK_API_KEY et al.) without
touching a single file (ds-review-bot finding on #233).

Spawn with env: {} and a hermetic execArgv on both runtime shapes, the
same stance as dsh-code-runtime-worker and stronger than the scrubbed
env the defensive-patterns rule requires for spawned commands (a shell
needs PATH; this worker needs nothing). Ambient-channel hardening only:
an escapee keeps the process-wide privileges the trust premise already
admits - the genuine sandbox remains an engine swap.

packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts

@@ -254,6 +254,24 @@ describe('dsh-workflow-workerthread', () => {
       expect(result.stopReason).toBe('completed')
       expect(result.value).toBe('fine')
     })
+
+    it('the worker spawns with an EMPTY environment: an escaped script finds no ambient credentials', async () => {
+      const { ctx, parent } = await setup()
+      // A canary in the HARNESS process's env: with an inherited environment
+      // the escape below would read it back (exactly how DEEPSEEK_API_KEY
+      // would leak); env: {} in the spawn options is what keeps it out.
+      process.env.WORKFLOW_ENV_CANARY = 'leak me'
+      try {
+        const result = await run(ctx, parent, scripted(`
+          const proc = ${ESCAPE}
+          return { canary: proc.env.WORKFLOW_ENV_CANARY ?? null, keys: Object.keys(proc.env).length }
+        `))
+        expect(result.stopReason).toBe('completed')
+        expect(result.value).toEqual({ canary: null, keys: 0 })
+      } finally {
+        delete process.env.WORKFLOW_ENV_CANARY
+      }
+    })
   })
 
   describe('lifecycle: parse errors, cancellation, termination, disposal', () => {