Add snippet working directory and env files

[timzhong1024]

Summary

• add --cwd DIR for the final snippet process while keeping template setup and dependency installation isolated
• add dotenv-compatible --env-file FILE loading without mutating the parent shell
• keep env-file values out of displayed commands and preserve runner-owned isolation variables
• support the execution context across Python, Node, Rust, Go, and .NET, including stdin direct mode
• document semantics and security guidance in both READMEs, the npm README, CLI help, and bundled agent skill

Isolation semantics

--cwd does not move the temporary template or make run-code execute inside an existing project. The source snippet and dependencies remain in the generated isolated template. Only the final code process sees the requested working directory.

Environment values are supplied for the final launch and snippet process. They are not added to the current shell or earlier setup/dependency-installation commands, and their values are omitted from displayed commands.

Verification

• cargo fmt --check
• cargo clippy --locked --all-targets -- -D warnings
• cargo test --locked (31 tests)
• cargo package --locked
• npm wrapper syntax and dry-run package validation
• Python and Node stdin execution with --cwd and --env-file
• Python, Node, Rust, Go, and .NET file execution with cwd fixture access, dotenv values, and argument passthrough
• all five file backends repeated with third-party dependencies to verify dependency resolution remains in the isolated template