fix(agent): stop host env vars from overriding renamed secret bindings

[radim10]

Summary

• When an agent profile renamed a secret with env = "...", a host variable with that same name (e.g. a stale GITHUB_PAT_TOKEN in the invoking shell) replaced the fetched secret. The proxy then injected the wrong credential and GitHub returned 401 Bad credentials.
• Cause: expand_and_inject_env lets process env override secret values, and it runs after apply_secret_bindings has already renamed the secret to its env name.
• Fix: agent-profile runs (non-empty secret bindings) now use expand_env_without_process_override. Values are still expanded, but a host variable can't replace them. Plain stashbase run behaves as before.

Test plan

• Unit test: host var with the bound name doesn't override the fetched value
• Profile parsing test: env rename alongside [secrets] project/environment
• Proxy test: placeholder injection works for a renamed binding
• Manual: Docker profile with env = "GITHUB_PAT_TOKEN" authenticates against api.github.com/user