Correct provider-bridge environment inheritance documentation #2723

The work

Correct the provider-bridge environment documentation in docs/provider-bridge-protocol.md and its matching Plugin SDK declaration comment. Current main says:

The bridge's own environment is constructed by the runtime from an allowlist; bridges construct their children's environments the same way and must not leak their own inherited env downward (#1366, #1545).

The docs should instead describe the shipped denylist behavior without changing runtime or bridge behavior.

Why now

On main at f4bbc2fe81a9b7639ff9a7396e172bddd89109e4, sanitizeInheritedChildProcessEnv removes only NODE_ENV, BB_*, and undefined values while retaining the rest of the inherited environment. spawnProvider overlays the runtime and bridge-specific environment on that result, and withoutBridgeRuntimeEnv removes only ELECTRON_RUN_AS_NODE and BB_PROVIDER_BRIDGE_RECORD_DIR from provider-child environments.

The allowlist wording was introduced by commit c5b53caab5 in #1640 even though that commit's bridge spawn path used the existing denylist. #1366 established removal of inherited bb thread context, #1402 covers provider-process pipe and replacement races, and #1545 documents a non-bb Volta variable that continued to pass through. Searches for the quoted sentence and equivalent provider-bridge environment claims found no existing issue.

Acceptance criteria

• State which inherited names the runtime removes, how PATH, bridge variables, and declared env.passthrough values are overlaid, and which bridge-runtime names provider-child builders remove.
• Preserve intentional inheritance of ordinary provider auth, proxy, and platform variables.
• Remove the duplicate allowlist claim from the Plugin SDK declaration comment and the record-mode paragraph; leave unrelated allowlists untouched.
• Make no executable-code or provider-environment behavior change.

AGENT GENERATED