fix(cache): honor explicit untrackedEnv for tool-reported reads

[jasonkuhrt]

Note

AI-authored PR. Code and tests by Codex (GPT-6); reviewed by Claude Opus 5.5.

Motivation

Refs #505; related proposal: #693.

Currently untrackedEnv controls the spawned environment, but tools' tracked getEnv and getEnvs reads still invalidate the cache for those variables. This makes it impossible for task config to exclude volatile values from broad tool-reported queries.

Explicit cache.untrackedEnv patterns now override both scalar and bulk tool-reported dependencies, including additions and removals. This changes existing explicit configs: to keep a tool-reported variable tracked, declare it in cache.env or exclude it from untrackedEnv with !. Command-prefix assignments remain fingerprinted.

For GitHub Actions run metadata, a task can explicitly configure untrackedEnv: ['ACTIONS_*', 'GITHUB_*', 'RUNNER_*']. Built-in passthrough defaults do not cancel tool-reported tracking, so default configs are unchanged: a Vite build still invalidates when VITE_MAPBOX_TOKEN changes.

Complete observations remain stored, so removing an exclusion restores invalidation even with an unchanged cache key. Validation uses filtered iterators and compiles an override matcher only when needed. Existing default patterns, serialized cache keys and the cache format are unchanged.