prepare_subprocess_env: remove all passphrase-related env vars and BORGSTORE_REST_PASSWORD

[ThomasWaldmann]

prepare_subprocess_env() removed only BORG_PASSPHRASE from the environment it prepares for the subprocesses borg starts (the command given in BORG_PASSCOMMAND, --paths-from-command / --content-from-command commands, tar filter commands, borg with-lock commands, fusermount/umount, fakeroot detection, ssh for legacy borg 1.x repos). This PR extends that to all passphrase-related variables and borgstore's REST password, see the discussion in #6480.

Now removed:

• BORG_PASSPHRASE, BORG_NEW_PASSPHRASE, BORG_OTHER_PASSPHRASE: secrets.
• BORG_PASSCOMMAND, BORG_OTHER_PASSCOMMAND: often embed secrets (echo ...) or paths to them.
• BORG_PASSPHRASE_FD, BORG_OTHER_PASSPHRASE_FD: the file descriptors are not inherited by the subprocess (Popen closes them, no pass_fds anywhere), so the numbers would be dangling and misleading in the child.
• BORGSTORE_REST_PASSWORD: borgstore's REST authentication password. It is the only secret among borgstore's env vars (BORGSTORE_RSH, BORGSTORE_REST_USERNAME, BORGSTORE_LATENCY, BORGSTORE_BANDWIDTH, BORGSTORE_RCLONE_DEBUG, RCLONE_BINARY).

Reviewed and kept: BORG_REPO, BORG_OTHER_REPO, BORG_KEY_FILE and all the other BORG_* variables from borg help environment are not secrets, and with-lock scripts may rely on BORG_REPO. Note that a BORG_REPO REST URL with embedded user:password@ would still be passed on; credentials belong in BORGSTORE_REST_USERNAME / BORGSTORE_REST_PASSWORD.

Also:

• documents the removal in the BORG_PASSPHRASE help text (docs/usage/general/environment.rst.inc is generated from it, not regenerated here),
• adds tests for prepare_subprocess_env() (there were none),
• adds a changelog entry.

Not in scope here (separate follow-up, see the issue comment): the in-place wipe of the kernel-provided environment block and removing the variables from os.environ early, so that the ssh process spawned by borgstore's REST-over-ssh backend does not inherit them either.

Tests run locally (macOS): helpers/process_test.py, helpers/passphrase_test.py, archiver/lock_cmds_test.py, archiver/key_cmds_test.py, archiver/tar_cmds_test.py, archiver/create_cmd_test.py -k command; ruff check and format are clean.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.87%. Comparing base (9056ef4) to head (b2b1a42).
⚠️ Report is 3 commits behind head on master.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##           master   #10341   +/-   ##
=======================================
  Coverage   87.86%   87.87%           
=======================================
  Files         103      103           
  Lines       18876    18878    +2     
  Branches     2915     2916    +1     
=======================================
+ Hits        16586    16589    +3     
  Misses       1589     1589           
+ Partials      701      700    -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.