PTY env authorization bypass

Trap: inheriting the service-manager or client environment looks convenient, but it can leak /home/byk/.opencode/env credentials or let client-controlled values alter execution. Fix: accept no environment or systemd property names from clients; the fixed launcher must call clearenv() and set only HOME, LANG, PATH, SHELL, and TERM before executing /usr/bin/script.