sec (2/9): reject inline env values in user-defined scanners

[jesse-merhi]

What changes

A user-defined scanner's env: list must contain bare variable names
(API_TOKEN), never inline NAME=value pairs. An entry with an = is rejected
at config-resolution time, and — critically — the rejected value is never
echoed in the error.

Why it matters

env: exists so a scanner can be handed a secret that ClawScan reads from the
process environment and records only by presence (present/missing). If an
author writes API_TOKEN=sk-live-... inline, the secret would live in the
config file and could surface in logs/errors. Requiring bare names keeps secret
values out of config entirely, matching the repo rule "record env presence,
never values."

Before / after (runnable)

env.yml:

version: 1
profiles:
  demo:
    scanners:
      - id: foo
        command: "scan {{target}}"
        env:
          - "API_TOKEN=sk-live-secret"

	Behavior
Before	inline NAME=value accepted; secret value carried in config
After	rejected, and the error omits the value:

$ clawscan ./skill --config env.yml --profile demo --sandbox off --json
User-defined scanner foo in profile demo has an invalid env entry "API_TOKEN";
declare bare variable names and set values in the environment, not inline

The reject message names API_TOKEN but does not contain sk-live-secret.
A bare env: [API_TOKEN] is still accepted.

Verify

go test ./internal/profiles/ -run 'UserDefinedScannerEnv' -count=1

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: sec (2/9): reject inline env values in user-defined scanners This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.