GHSA-h539-c7r8-3xq4: CodeWhale: js_execution leaks parent environment to model context via missing env scrub

CodeWhale's js_execution tool fails to scrub sensitive environment variables (like API keys and cloud credentials) before running model-provided JavaScript code, allowing these secrets to leak back to the AI model through the tool's output. Other tools in the same codebase use an environment allowlist (child_env helper) to prevent this, but js_execution was added four days after that security fix and never implemented it.