whitelist env to pass to spawned subprocesses

rather than starting with everything.
Reduces risk of leaking security-related environment variables to kernels.