buzz repo failure: AppImage leaks LD_LIBRARY_PATH/PYTHONHOME/PYTHONPATH into child processes — "Fetch repository" fails on any distro with OpenSSL ≥ 3.2

**Summary**

The Buzz Desktop AppImage exports `LD_LIBRARY_PATH`, `PYTHONHOME`, and `PYTHONPATH` pointing at its internal bundle, and every child process it spawns inherits these. System tools launched by Buzz — notably `git-remote-https` when fetching a repository — then resolve libraries and interpreters from the AppImage instead of the OS. On any distribution whose system libraries are built against OpenSSL 3.2+ (Arch, Fedora 40+, Ubuntu 24.10+, Tumbleweed), HTTPS git operations abort with missing `OPENSSL_3.2.0`/`OPENSSL_3.5.0` symbol versions, and the system `python3` fails to start entirely. This breaks the Fetch repository button for Buzz-hosted repos (HTTPS clone with the `git-credential-nostr` helper) and for any HTTPS clone, app-wide.

**Environment**

- Buzz Desktop 0.5.2, AppImage (`Buzz_0.5.2_amd64.AppImage`)
- Arch Linux (rolling), system OpenSSL 3.6

**Steps to reproduce**

1. On a distro with OpenSSL ≥ 3.2, launch Buzz Desktop.
2. Press Fetch on a Buzz-hosted repository (or any repo registered with an HTTPS clone URL).
3. Observe:

```
/usr/lib/git-core/git-remote-https: /tmp/.mount_Buzz_XXX/usr/lib/libssl.so.3: version `OPENSSL_3.2.0' not found (required by /usr/lib/libcurl.so.4)
/usr/lib/git-core/git-remote-https: /tmp/.mount_Buzz_XXX/usr/lib/libssl.so.3: version `OPENSSL_3.5.0' not found (required by /usr/lib/libngtcp2_crypto_ossl.so.0)
fatal: remote helper 'https' aborted session
```

**Root cause (verified)**

- Bundled `libssl.so.3` exports symbol versions only up to `OPENSSL_3.0.3`; the system `libssl.so.3` exports up to `OPENSSL_3.6.0`, and system `libcurl.so.4` requires `OPENSSL_3.2.0`/`OPENSSL_3.5.0`. The bundled old library wins purely due to search order.
- In any Buzz-spawned child: `LD_LIBRARY_PATH` contains `/tmp/.mount_Buzz_*/usr/lib/` (three stale mount dirs in my env — mounts from earlier runs/upgrades accumulate), `PYTHONHOME=/tmp/.mount_Buzz_*/usr/`, `PYTHONPATH=/tmp/.mount_Buzz_*/usr/share/pyshared/...`.
- Reproductions from a Buzz-spawned shell:
- `git clone ` fails with the error above; same command as `env -u LD_LIBRARY_PATH git clone ...` works.
- `python3` dies on startup with `Fatal Python error: Failed to import encodings module` (stdlib searched inside the AppImage); clears once `PYTHONHOME`/`PYTHONPATH`/`LD_LIBRARY_PATH` are unset.
- SSH git transports work under the same environment (OpenSSH doesn't link the affected libcurl/ngtcp2 chain) — confirming the system OpenSSL install is fine; the problem is strictly the inherited environment.

**Suggested fix**

Scrub AppImage-internal environment variables (`LD_LIBRARY_PATH`, `LD_PRELOAD`, `PYTHONHOME`, `PYTHONPATH` — ideally all vars whose values point into the mount) from the environment before spawning any child process. One scrub in the spawn helper fixes repo fetch, agent runtimes, and all future subprocesses. Internally, the app should locate its bundled libraries via rpath/`$ORIGIN` rather than process-global env vars. Optional: clean up stale `/tmp/.mount_Buzz_*` mounts on exit/startup.

**Workaround for users until fixed**

Drop a git shim earlier in PATH, e.g. `~/.cargo/bin/git`:

```sh
#!/bin/sh
exec env -u LD_LIBRARY_PATH -u LD_PRELOAD -u PYTHONHOME -u PYTHONPATH /usr/bin/git "$@"
```

Verified on the affected machine. (`git config --global url."git@github.com:".insteadOf "https://github.com/"` additionally defangs GitHub-only fetches by forcing SSH.)

**Impact**

Every subprocess Buzz spawns on modern distros: repository fetch fails outright; agent runtimes inherit the poisoned env, breaking the system git for HTTPS and the system Python interpreter — and any other host tool whose resolution env collides with AppImage-exported variables.

Start at the subprocess spawn helper used by the Fetch repository action and inspect how AppImage environment variables are inherited. Verify the fix by fetching an HTTPS repository and by launching git clone and python3 from a Buzz-spawned child; done means host tools no longer see the AppImage paths while Buzz still runs.

Written by the indexing model from the issue text.