Revert "fix: preserve run provider capability"

This reverts commit 63c86322de.

hub/test/unit/agent-security.test.ts

@@ -66,7 +66,10 @@ describe("agent subprocess security policy", () => {
         allowRead: expect.arrayContaining([canonicalWorkspace, "/usr/bin"]),
       },
       credentials: {
-        envVars: [],
+        envVars: expect.arrayContaining([
+          { name: "ANTHROPIC_AUTH_TOKEN", mode: "deny" },
+          { name: "ANTHROPIC_API_KEY", mode: "deny" },
+        ]),
       },
     });
   });

hub/test/unit/runner.test.ts

@@ -288,7 +288,10 @@ describe("runAgent", () => {
         },
         sandbox: {
           credentials: {
-            envVars: [],
+            envVars: expect.arrayContaining([
+              { name: "ANTHROPIC_AUTH_TOKEN", mode: "deny" },
+              { name: "ANTHROPIC_API_KEY", mode: "deny" },
+            ]),
           },
         },
       },