fix: filter inherited env vars overridden by per-session envExtra

Prevents the agent from using the user's global OLLIE mount to
bypass per-session permission enforcement.

pkg/tools/execute/server.go

@@ -578,7 +578,16 @@ func (e *Server) executeWithStdin(ctx context.Context, code, language string, ti
 	}
 
 	e.envMu.RLock()
-	cmd.Env = prependOlliePath(os.Environ())
+	baseEnv := os.Environ()
+	// Remove keys that envExtra overrides so duplicates don't leak through.
+	filtered := baseEnv[:0]
+	for _, ev := range baseEnv {
+		k, _, _ := strings.Cut(ev, "=")
+		if _, overridden := e.envExtra[k]; !overridden {
+			filtered = append(filtered, ev)
+		}
+	}
+	cmd.Env = prependOlliePath(filtered)
 	cmd.Env = append(cmd.Env, "OLLIE_TOOLS_PATH="+ToolsPath())
 	for k, v := range e.envExtra {
 		cmd.Env = append(cmd.Env, k+"="+v)