Stop handing StackPilot's own settings to the stacks it deploys (0.66.3)

docker compose ran with StackPilot's whole environment, and compose
resolves ${VAR} from the calling environment before a stack's own .env.
A stack whose compose file says SECRET_KEY: ${SECRET_KEY} therefore ran
with StackPilot's SECRET_KEY instead of the one in its .env — and with
its own again whenever it was started from a shell. AnsiblePilot hit
exactly this: credentials saved under one key became unreadable under
the other, twice.

config.child_env() is os.environ minus every StackPilot setting
(SECRET_KEY, DATA_DIR, STACKS_DIR, PORT, ...); the docker CLI and git
subprocesses now get that instead.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/services/git_service.py

@@ -39,7 +39,7 @@ from typing import Optional
 
 from sqlmodel import Session
 
-from config import settings
+from config import child_env, settings
 from models.git_source import GitSource, SyncResult
 from services import compose_service, crypto_service, stack_lock_service
 
@@ -124,7 +124,7 @@ def _auth_env(source: GitSource) -> tuple[dict, Optional[str]]:
     with their whole stack.
     """
     env = {
-        **os.environ,
+        **child_env(),
         # No interactive prompting: a private repo without credentials must fail
         # fast rather than hang forever waiting on a terminal that is not there.
         "GIT_TERMINAL_PROMPT": "0",