feat(security): add config env_set support

- Add EnvSet field to ExecConfig for config file
- Merge env_set into cachedEnv at ExecTool init
- LLM env overrides still checked against blocklist

pkg/config/config.go

@@ -645,6 +645,7 @@ type ExecConfig struct {
 	CustomDenyPatterns  []string          `                                 env:"PICOCLAW_TOOLS_EXEC_CUSTOM_DENY_PATTERNS"  json:"custom_deny_patterns"`
 	CustomAllowPatterns []string          `                                 env:"PICOCLAW_TOOLS_EXEC_CUSTOM_ALLOW_PATTERNS" json:"custom_allow_patterns"`
 	TimeoutSeconds      int               `                                 env:"PICOCLAW_TOOLS_EXEC_TIMEOUT_SECONDS"       json:"timeout_seconds"` // 0 means use default (60s)
+	EnvSet              map[string]string `                                 json:"env_set"` // env vars to set for all exec commands
 }
 
 type SkillsToolsConfig struct {

pkg/tools/shell.go

@@ -138,6 +138,12 @@ func NewExecToolWithConfig(workingDir string, restrict bool, config *config.Conf
 		timeout = time.Duration(config.Tools.Exec.TimeoutSeconds) * time.Second
 	}
 
+	// Get envSet from config (if provided)
+	var envSet map[string]string
+	if config != nil && config.Tools.Exec.EnvSet != nil {
+		envSet = config.Tools.Exec.EnvSet
+	}
+
 	return &ExecTool{
 		workingDir:          workingDir,
 		timeout:             timeout,
@@ -145,7 +151,7 @@ func NewExecToolWithConfig(workingDir string, restrict bool, config *config.Conf
 		allowPatterns:       nil,
 		customAllowPatterns: customAllowPatterns,
 		restrictToWorkspace: restrict,
-		cachedEnv:           shell.BuildSanitizedEnv(os.Environ(), nil, nil, nil),
+		cachedEnv:           shell.BuildSanitizedEnv(os.Environ(), nil, envSet, nil),
 	}, nil
 }