security: isolate every gstack Bun entry point from the audited checkout's .env and bunfig.toml

Bun auto-loads .env, .env.local and .env.<NODE_ENV> from its cwd and runs a
cwd bunfig.toml preload before the program starts. gstack runs inside the repo
it audits, so a committed .env could steer state roots, the claude binary or
spend caps, and a bunfig preload ran arbitrary code in every bin and hook.

Every bun shebang, shell and skill caller, TypeScript spawn and compiled build
now disables both (--no-env-file --config=/dev/null, bunIsolationArgs(),
--no-compile-autoload-dotenv/bunfig), with a ratchet and hostile-fixture
regressions.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

lib/script-invocation.ts

@@ -32,6 +32,7 @@ import { spawnSync, type SpawnSyncOptions, type SpawnSyncOptionsWithStringEncodi
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { bunIsolationArgs } from './bun-isolation';
 import { resultLine } from './result-codes';
 
 export const BIN_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', 'bin');
@@ -205,7 +206,7 @@ function windowsBash(o: InvocationOptions): { ok: true; bash: string } | { ok: f
 
 /** How to run a gstack shebang bin on this platform. */
 export function scriptInvocation(script: string, args: readonly string[], o: InvocationOptions = {}): Invocation {
-  if (/^#!.*\bbun\b/.test(readShebang(script))) return { ok: true, cmd: o.bunExe ?? bunExecutable(), argv: [script, ...args] };
+  if (/^#!.*\bbun\b/.test(readShebang(script))) return { ok: true, cmd: o.bunExe ?? bunExecutable(), argv: [...bunIsolationArgs((o.platform ?? process.platform) as NodeJS.Platform), script, ...args] };
   if ((o.platform ?? process.platform) !== 'win32') return { ok: true, cmd: script, argv: [...args] };
   const bash = windowsBash(o);
   return bash.ok ? { ok: true, cmd: bash.bash, argv: [slash(script), ...args] } : bash;