Stop leaking PIMONITOR_API_KEY into vcgencmd's environment

[LarsLaskowski]

📖 Description

vcgencmdRunner.run() left cmd.Env nil, so vcgencmd inherited the full service environment — including PIMONITOR_API_KEY when it's configured via the environment, as SECURITY.md itself recommends. That copies the secret into vcgencmd's /proc/<pid>/environ for no reason, the same class of exposure the -api-key flag's warning already exists to avoid.

internal/collector/updates.go was already fixed for the same underlying issue by #117 (which built an explicit cmd.Env while pinning apt's locale), so that half of the originally reported issue no longer applies — verified by re-reading the current source before starting, per the note on the issue. This PR applies the same approach to vcgencmd.go: since it's invoked by the absolute path resolved by exec.LookPath at detection time, it needs no PATH at all, so its child environment is set to an explicit empty slice (cmd.Env = []string{}, not nil, which would inherit).

Also updates SECURITY.md's "Threat Model / Design Notes" section with a bullet describing this explicit-minimal-environment approach for subprocesses.

🎫 Issues

Closes #104

👩‍💻 Reviewer Notes

The interesting bit is internal/collector/vcgencmd_test.go: vcgencmdRunner already separates detection (path field) from execution, so the test injects a fake vcgencmd script directly via the path field (no new seam needed) and asserts the captured child environment neither contains PIMONITOR_API_KEY nor PATH.

📑 Test Plan

• Added TestVcgencmdRunner_Run_DoesNotLeakParentEnvironment in internal/collector/vcgencmd_test.go: sets PIMONITOR_API_KEY via t.Setenv, runs a fake vcgencmd script that dumps its own environment to a file, and asserts the secret (and PATH) are absent from the captured output.
• go build ./..., go vet ./..., go test ./... -race -cover, and golangci-lint run all pass locally.

✅ Checklist

General

• I have added/updated tests for my changes (go test ./... -race -cover passes locally).
• go vet ./... and golangci-lint run are clean.
• I have tested my changes.
• I have read the CONTRIBUTING documentation and followed the project's code style guidelines.
• I have updated ARCHITECTURE.md if this changes a documented design decision. (Not applicable — no documented design decision changes, just hardens an existing one.)

REST API / configuration / packaging

Not applicable — no REST API, configuration, or packaging changes.

⏭ Next Steps

The issue's optional follow-up (config.Load calling os.Unsetenv("PIMONITOR_API_KEY") after reading it, to remove the key from /proc/self/environ entirely) is intentionally out of scope here, as noted in the original issue.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud