fix: harden P1 integration evidence

scripts/p1-acceptance.sh

@@ -8,10 +8,14 @@ fi
 for command in node npm git; do command -v "$command" >/dev/null || { printf 'missing command: %s\n' "$command" >&2; exit 127; }; done
 THT_BIN="${THT_BIN:-$repo_root/harness/.venv/bin/tht}"
 [[ "$THT_BIN" = /* && -x "$THT_BIN" ]] || { printf 'THT_BIN must be an absolute executable path\n' >&2; exit 127; }
-export THT_BIN
 npm --prefix "$repo_root/backend" run build
+safe_env=(env -i "PATH=$PATH" "HOME=${HOME:-/nonexistent}" "LANG=${LANG:-C}" "THT_BIN=$THT_BIN")
+for name in LC_ALL TMPDIR TZ; do
+  [[ -n "${!name:-}" ]] && safe_env+=("$name=${!name}")
+done
+[[ -n "${P1_ACCEPTANCE_FAIL_AT:-}" ]] && safe_env+=("P1_ACCEPTANCE_FAIL_AT=$P1_ACCEPTANCE_FAIL_AT")
 set +e
-node "$repo_root/backend/scripts/p1-acceptance.mjs" "$@"
+"${safe_env[@]}" node "$repo_root/backend/scripts/p1-acceptance.mjs" "$@"
 status=$?
 set -e
 exit "$status"