fix: isolate iOS native review environment

[jedwards27]

Summary

• replace inherited os.environ for flutter drive with a minimal host-tool allowlist
• preserve only the explicit native-review flags for the app child
• add regression coverage proving Buzz keys/auth tags and representative cloud/GitHub credentials are scrubbed
• document the iOS environment-isolation contract

Validation

Exact clean commit: ed30bef7c73d9c3964e0989f58c284ca19621a12

• python3 -m unittest discover -s tools/native-review/tests -p 'test_*.py' — 25/25 passed
• causal mutation adding BUZZ_PRIVATE_KEY to the allowlist — focused regression failed with the leaked key in the child environment
• just native-review-ios 'iPhone 17 Pro' — passed on iOS 26.5; 2 Flutter tests passed; visible Buzz screenshot; 27.69s H.264 1206×2622 video; cleanup passed and simulator shutdown
• pre-push hooks — branch skew, Desktop check/typecheck/4,954 tests, mobile tests, Rust tests, and Tauri checks passed

Artifacts: test-results/native-review/ed30bef7c73d/ios_pairing/ios-20260815T110314-2e5c35/

This is intentionally stacked on block#5972 so the hardening follows the native-review documentation stack. Retarget/open upstream after the stack below lands.

[jedwards27]

Superseded: this commit was fast-forwarded onto the existing upstream stack PR block#5972.