AppImage leaks bundled library env (LD_LIBRARY_PATH, PYTHONHOME, …) into child processes, breaking system git/curl/python3

**Environment:** Buzz Desktop AppImage on Pop!_OS 24.04 LTS (system libcurl-gnutls from noble).

## Summary

Every child process Buzz Desktop spawns (agent harness shells, the in-app PR merge's `git`, etc.) inherits the AppImage runtime's environment pointing into the mount dir. The bundled libraries are older than what system binaries link against, so common system tools crash or misbehave when launched from inside Buzz.

Leaked variables observed in a Buzz-spawned process:

```
LD_LIBRARY_PATH=/tmp/.mount_Buzz_XXXXXX/usr/lib/:/tmp/.mount_Buzz_XXXXXX/usr/lib/x86_64-linux-gnu/:… (10 entries)
PYTHONHOME=/tmp/.mount_Buzz_XXXXXX/usr/
PYTHONPATH=/tmp/.mount_Buzz_XXXXXX/usr/share/pyshared/:
PERLLIB=… GTK_PATH=… QT_PLUGIN_PATH=… GST_PLUGIN_SYSTEM_PATH=… XDG_DATA_DIRS=…
PATH=…:/tmp/.mount_Buzz_XXXXXX/usr/bin:…
APPDIR=/tmp/.mount_Buzz_XXXXXX
```

## Concrete breakage

The AppImage's bundled `libnghttp2` is older than what the system's `libcurl-gnutls` needs, so **any HTTPS git operation spawned from Buzz crashes**:

```
/usr/lib/git-core/git-remote-https: symbol lookup error: /lib/x86_64-linux-gnu/libcurl-gnutls.so.4:
undefined symbol: nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation
```

This took down the in-app PR merge (its temp-dir `git clone` dies on the spot) and broke `curl` the same way. `PYTHONHOME`/`PYTHONPATH` similarly break the system `python3` (wrong bundled stdlib).

## Repro

1. Launch Buzz Desktop from the AppImage on a distro whose libcurl is newer than the bundled nghttp2 (Pop!_OS 24.04 / Ubuntu noble).
2. From anything Buzz spawns (agent shell, in-app merge): `git ls-remote https://github.com//.git`
3. Symbol lookup crash above. Same command with `env -u LD_LIBRARY_PATH` works fine.

## Expected

Child processes that aren't bundled binaries should get a sanitized environment — capture the pre-`AppRun` values and restore them when spawning (or at minimum strip all `$APPDIR`-derived entries from `LD_LIBRARY_PATH`, `PYTHONHOME`, `PYTHONPATH`, `PATH`, etc.). This is a well-known AppImage footgun; Electron-based AppImages commonly restore `ORIGINAL_*` env vars for children.

## Workaround we're using

PATH-first wrapper scripts in `~/.local/bin` for `git`/`curl`/`python3` that strip `/tmp/.mount_*` entries from `LD_LIBRARY_PATH` (and unset `PYTHONHOME`/`PYTHONPATH`) before exec'ing the real binary.