hermetic::command leaves color env ambient (CLICOLOR_FORCE=1 fails a list test), and its HOSTILE_SEEDS seed-then-remove the same list so they can never catch a dropped scrub #1958

[agent] Filed by the scheduled architecture audit (audit-cli-tests). Register: register comment.

Kind: bug (test hermeticity). Register ID: T59.

Problem

1. Color env reaches test children. The CLI decides color from NO_COLOR, CLICOLOR_FORCE, CLICOLOR and TERM, and table width from COLUMNS (ui/mod.rs L163-L218). hermetic::command removes SOCKET_* but none of those. A developer's or CI runner's CLICOLOR_FORCE puts ANSI codes into captured stdout and breaks .contains assertions. Executed on main @ cbbbdb9:

$ CLICOLOR_FORCE=1 cargo test -p socket-patch-cli --test cli_parse_list
populated_manifest_plain_lists_full_record_via_binary --- FAILED (cli_parse_list.rs:481)
test result: FAILED. 68 passed; 1 failed

update_notifier_e2e works around CI/GITHUB_ACTIONS itself, which is a sign the base builder should own this.

2. The hostile seeds are theatre. hermetic.rs L39-L94:

for (k, v) in HOSTILE_SEEDS { cmd.env(k, v); }
for (k, _) in HOSTILE_SEEDS { cmd.env_remove(k); }

The doc claims a dropped scrub line "turns tests red". But dropping an entry drops its seed and its removal together, and a kept entry is always removed. So the seeds can never be observed. The Extra::Yarn/Pnpm/Bundle seeds at L344-L387 follow the same pattern, each with an unconditional env_remove right after the seed.

3. HOME isolation is path-dependent. jvm_env::isolate_cli (the HOME pin) runs only on common::run_bin_with_env. Suites that call hermetic::binary_command/hermetic_command directly (about 150 files) run the CLI under the real HOME, yet the module doc calls command "the one hermetic environment".

Proposed change

• In hermetic::command, remove NO_COLOR, CLICOLOR, CLICOLOR_FORCE, COLUMNS, CI and GITHUB_ACTIONS, and set TERM=dumb, the way the SOCKET_* sweep works. Tests that exercise color (the ui render tests, prompts_tty) opt back in explicitly.
• Delete HOSTILE_SEEDS, the seed loop and the doc claim, plus the per-Extra seeds. If a real canary is wanted, add one test that seeds a var in the parent env, builds a command, and asserts the child's get_envs() removes it.
• Either move the HOME pin into hermetic::command, or correct the module doc to say which builder isolates HOME. The pin is the better fix; the T53 discussion of SOCKET_PROXY_URL is separate.

Size

tests/common/hermetic.rs, and possibly common/jvm_env.rs. About −40 / +15 lines.

Acceptance criteria

• CLICOLOR_FORCE=1 NO_COLOR= COLUMNS=20 cargo test -p socket-patch-cli --test cli_parse_list --test output_modes_e2e passes (the first fails today).
• HOSTILE_SEEDS is gone.
• All tests that pass today still pass.