feat(cli): add -e/--env flag for passing env vars as scrubbed secrets

[sd2k]

Summary

• Adds -e KEY=VALUE / -e KEY CLI flags (Docker-style) to pass environment variables into the sandbox
• Values are passed through the existing secrets API, so they're automatically scrubbed from stdout/stderr/file output
• -e KEY (without value) inherits from the host environment, errors if not set

Changes

• _cli.py: New "environment" argument group with -e/--env, new make_secrets() helper
• __main__.py: Wire make_secrets() into both _run_once() and _repl() paths
• test_cli.py: 12 new tests (7 unit tests for make_secrets, 5 integration tests for CLI flag)

Example

# Explicit value (scrubbed from output)
eryx -e API_KEY=sk-xxx -c 'import os; print(os.environ["API_KEY"])'
# Output: [REDACTED]

# Inherit from host
export DATABASE_URL=postgres://...
eryx -e DATABASE_URL -c 'import os; print(os.environ["DATABASE_URL"])'
# Output: [REDACTED]

Testing

• 12 new tests all passing locally
• All 33 CLI tests pass (21 existing + 12 new)

🤖 Generated with Claude Code