audit: wrap patches in ENV.with_build_environment block