test(claude-code): provider environment ignores process spawn hooks

docs/claude-code-provider.md

@@ -38,7 +38,10 @@ conversation is replayed each time.
    --include-partial-messages --verbose`, `--system-prompt-file <tmp>`, `--model <id>`, `--effort <level>`,
    plus settings that disable hooks, auto-memory, plugins, slash commands and the token reminder (which would
    defeat prompt caching). Only an allow-list of environment variables is passed through, and compaction
-   inside Claude is disabled: the core owns compaction.
+   inside Claude is disabled: the core owns compaction. `claude` and its login/doctor processes don't go
+   through the host's process spawn policy (`AgenticCoreOptions.ProcessEnvironment`): they already get a
+   replaced, allow-listed environment. The Bridge inherits `claude`'s environment, and the core tools it
+   advertises (such as `bash`) run in the core, so they go through the policy like any other tool call.
 3. The bridge (a tiny console app) is the MCP server. It answers `initialize` and `tools/list` with the
    catalogue and touches a "ready" marker file. It **never executes** anything: `tools/call` returns an error
    and touches a "violation" marker that fails the request.