env_config: scrub the managed PYAUTO_ family from the base env (step 3)

[Jammy2211]

Summary

Migration step 3 of the env-profile redesign (PyAutoBuild#161; campaign #155 Phase 3): scrubbed base env. build_env_for_script strips the managed PYAUTO_* family from the ambient environment before layering the profile, so a PYAUTO_ var's value for a script run is a function of (profile, script) — an ambient PYAUTO_DISABLE_JAX / PYAUTO_SKIP_* the profile is silent on can no longer leak in.

Only PYAUTO_* is scrubbed — not infrastructure/reproducibility vars (PATH, PYTHONPATH, JAX_ENABLE_X64, NUMBA_CACHE_DIR, MPLCONFIGDIR). Those are set identically by the profiles and the CI step env, so ambient-vs-profile never causes a reproducibility bug for them; a deny-by-default allowlist over them (the doc's original §5 shape) would risk breaking the least-exercised release path on a single missed key. This is the corrected §5 design (see the #161 thread — the allowlist and the "reproduce against the real CI env" near-miss).

Paired change (must merge together, same branch name so the smoke gate cross-checks): the three *_workspace_test smoke profiles gain PYAUTO_SKIP_WORKSPACE_VERSION_CHECK: "1". The mega-run (workspace-validation.yml) injects that var ambiently and the smoke profile was silent on it; without the profile now owning it, the scrub would strip the injection and every mega-run smoke script would fail WorkspaceVersionMismatchError. (That is the near-miss a synthetic-clean-env proof missed last attempt.)

Proof (measured against BOTH real CI env models, not a synthetic clean env)

• mega-run env (carries the ambient SKIP_WORKSPACE_VERSION_CHECK): 65/65 scripts byte-identical PYAUTO_ resolution old-vs-new — the release-validation path does not change at all.
• PR-gate env: identical except the profile now provides SKIP_WORKSPACE_VERSION_CHECK (harmless — the check passes anyway with source installs).
• leak: an ambient PYAUTO_SKIP_API_GATE leaked into 65/65 scripts under old code, 0 under new.

API Changes

None — resolver internals. New module constant MANAGED_ENV_PREFIXES.

Test Plan

• 4 new unit tests (ambient PYAUTO_ scrubbed; profile wins for a managed key; infra vars pass through; None-config unchanged). Suite: 132 passed.
• Resolve-diff proof above.
• The three workspace_test smoke gates on the paired PRs exercise this end-to-end (they clone PyAutoBuild at the matching branch).

Generated by the PyAutoLabs agent workflow.