fix(analysis): refuse malformed OPENSYSML_TOOL_ENV_PASSTHROUGH names

[devin-ai-integration]

What and why

renderEnv forwarded every comma-separated entry of OPENSYSML_TOOL_ENV_PASSTHROUGH to os.LookupEnv unchecked. An entry such as BAD=VALUE is not a variable name; it is now refused before the process is composed:

OPENSYSML_TOOL_ENV_PASSTHROUGH lists "BAD=VALUE", which is not an environment variable name

Entries containing = or a NUL byte are refused; surrounding whitespace and empty entries are still tolerated. This closes the remaining review finding from #581 on the invocation block's environment composition.

How it was verified

• TestInvocationEnvPassthroughRefusesMalformedNames in internal/exec/analysis/invocation_test.go: a valid name forwards, BAD=VALUE and BAD = VALUE are refused with the exact message, empty entries are tolerated. (A NUL entry cannot be set through os.Setenv, so that branch is covered by code only.)
• go build ./..., go vet ./..., gofmt -l . empty, go test -count=1 ./internal/exec/analysis/..., python3 scripts/changelog.py check.

Checklist

• make test and make lint pass locally
• Tests added or updated for the change
• Documentation extended where it already covers the surface (docs/reference/environment.md)
• Changelog entry added as changes/unreleased/tool-env-passthrough-names.fixed.md
• baselines regenerated and make docs-counts run if a gate count moved (none moved)
• No internal work-item labels in the body, docs, or changelog

Link to Devin session: https://nasa-jpl-demo.devinenterprise.com/sessions/af142480eed947fc95efba5cb14c8511
Open in Devin Desktop: https://nasa-jpl-demo.devinenterprise.com/desktop/session/af142480eed947fc95efba5cb14c8511?variant=devin
Requested by: @HuiJun

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring