Remove control credentials before invoking unrelated subprocesses
A release orchestrator should not leave admission, lifecycle, or edge-auth credentials in its ambient environment while invoking unrelated tools. Copy required values into the narrow in-process client, remove them from the process environment, and pass an explicitly sanitized env…