feat(cli): validate prerequisites and seal installation plans

tools/tht/internal/compose/runner.go

@@ -59,7 +59,17 @@ type boundedStreamingRunner interface {
 
 // execRunner executes the Docker CLI. It never invokes a shell.
 type execRunner struct {
-	binary string
+	binary      string
+	environment []string
+}
+
+// NewRunnerWithEnvironment uses an explicit process environment, for document-owned Compose
+// configuration that must not inherit unrelated operator shell parameter overrides.
+func NewRunnerWithEnvironment(binary string, environment []string) Runner {
+	if binary == "" {
+		binary = "docker"
+	}
+	return execRunner{binary: binary, environment: append([]string{}, environment...)}
 }
 
 // NewRunner returns a runner for binary. An empty binary selects docker from PATH.
@@ -106,6 +116,9 @@ func (r execRunner) runBounded(ctx context.Context, args []string, stdin io.Read
 		}
 	}
 	command := exec.Command(r.binary, preparedArgs...)
+	if r.environment != nil {
+		command.Env = r.environment
+	}
 	configureProcess(command)
 	command.Stdin = stdin
 	overflow := make(chan struct{}, 1)