OpenClaw shell-env fallback trusted startup env and could execute attacker-influenced login-shell paths

Summary

### Summary OpenClaw shell-env fallback trusted startup environment values and could execute attacker-influenced login-shell startup paths before loading env keys.

### Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `>= 2026.1.5` and `<= 2026.2.21-2` - Fixed on `main`: `9363c320d8ffe29290906752fab92621da02c3f7` - Planned patched release version (pre-set): `2026.2.22`

### Details The vulnerable chain was in the shell-env fallback path:

1. `src/infra/shell-env.ts` - `resolveShell(env)` trusted `env.SHELL` when set. - `execLoginShellEnvZero(...)` executed `${SHELL} -l -c "env -0"` with inherited runtime env.

2. `src/config/io.ts` - Config env values were applied before shell fallback execution.

3. `src/config/env-vars.ts` / env policy coverage - `SHELL` handling was hardened, but startup-path selectors (`HOME`, `ZDOTDIR`) still needed explicit blocking in config env ingestion and sanitization for shell fallback execution.

With env/config influence, this could trigger unintended command execution in shell startup processing on the OpenClaw host process context.

### Fix Mainline hardening now: - blocks `SHELL`, `HOME`, and `ZDOTDIR` during config env ingestion used by runtime fallback, - sanitizes shell fallback execution env, pinning `HOME` to the real user home and dropping `ZDOTDIR` + dangerous startup vars, - adds regression tests for config env ingestion and shell fallback/path-probe sanitization.

### Fix Commit(s) - `9363c320d8ffe29290906752fab92621da02c3f7`

### Impact - Local code-execution risk in environments where attacker-controlled env/config input can reach shell-env fallback. - Under OpenClaw trust assumptions (`SECURITY.md`), this is not a public-remote issue and depends on crossing local trusted-operator boundaries.

### Release Process Note `patched_versions` is intentionally pre-set to the planned next release (`2026.2.22`) so once npm release is out, maintainers can publish advisory immediately.

OpenClaw thanks @tdjackey for reporting.