bug(core): external safety checker inherits full env and unbounded stdout (checker-runner.ts)

## What happened?

`packages/core/src/safety/checker-runner.ts:169-173` spawns third-party checker binaries with the full process env, and `packages/core/src/safety/checker-runner.ts:200-204` accumulates stdout without a cap:

```ts
const child = spawn(checkerPath, [], {
stdio: ['pipe', 'pipe', 'pipe'],
cwd: this.contextBuilder.config.getWorkingDir(),
env: { ...process.env, ...this.contextBuilder.config.env },
});
```

```ts
child.stdout.on('data', (data: Buffer) => {
stdout += data.toString();
});
```

Impact: (1) checker gets `GEMINI_API_KEY` and other secrets; (2) malicious/buggy checker can OOM the CLI via infinite stdout; (3) input includes full `toolCall` + context.

## What did you expect to happen?

Spawn with a minimal env allowlist (`PATH`, `SYSTEMROOT` only + explicit opts), cap stdout (e.g. 256KB → kill + `DENY`), and document the trust boundary for custom checkers.

## Client information

- Repo: `google-gemini/gemini-cli` @ `main` `9c1b0a610`
- Area: `packages/core/src/safety/checker-runner.ts:169-173,200-204`
- Platform: Windows (source checkout)

## Login information

N/A — local safety-checker execution path.

## Anything else we need to know?

**Fix direction:** minimal env, `maxBuffer`-style stdout cap with kill + `DENY` on overflow, redaction of secrets from checker input. Regression test: checker emitting >cap bytes → `DENY`, and env snapshot asserting no `GEMINI_API_KEY` leakage.

Fits the current sandbox/safety hardening track (#29214, #29216, #29171).

Start in packages/core/src/safety/checker-runner.ts at the spawn options around lines 169-173 and the stdout handler around lines 200-204. Trace how checker input and results become a safety decision, then add regression coverage for output exceeding the cap and for an environment snapshot without GEMINI_API_KEY. Done means overflow produces DENY, secrets are not exposed to the checker, and the trust boundary is documented.

Written by the indexing model from the issue text.