SUP-4218: Parity between host environment variable and those propagated to container in Docker plugin

[Mykematt]

• 32 additional BUILDKITE_* variables are now included in PROPAGATE_ENVIRONMENT block
• Tracing variables (5): BUILDKITE_TRACING_BACKEND, BUILDKITE_TRACING_SERVICE_NAME, BUILDKITE_TRACING_PROPAGATE_TRACEPARENT, BUILDKITE_TRACING_TRACEPARENT, BUILDKITE_TRACE_CONTEXT_ENCODING
• Pipeline signing variables (3): BUILDKITE_AGENT_JWKS_FILE, BUILDKITE_AGENT_JWKS_KEY_ID, BUILDKITE_AGENT_AWS_KMS_KEY
• Analytics/testing variables (2): BUILDKITE_ANALYTICS_TOKEN, BUILDKITE_TEST_SUITE_SLUG
• Build configuration variables (12): BUILDKITE_CANCEL_GRACE_PERIOD, BUILDKITE_COMMAND_EVAL, BUILDKITE_LAST_HOOK_EXIT_STATUS, BUILDKITE_LOCAL_HOOKS_ENABLED, BUILDKITE_NO_HTTP2, BUILDKITE_PLUGIN_VALIDATION, BUILDKITE_PLUGINS_ENABLED, BUILDKITE_REDACTED_VARS, BUILDKITE_SHELL, BUILDKITE_SIGNAL_GRACE_PERIOD_SECONDS, BUILDKITE_SSH_KEYSCAN, BUILDKITE_STRICT_SINGLE_HOOKS
• Git configuration variables (9): BUILDKITE_GIT_CHECKOUT_FLAGS, BUILDKITE_GIT_CLEAN_FLAGS, BUILDKITE_GIT_CLONE_FLAGS, BUILDKITE_GIT_CLONE_MIRROR_FLAGS, BUILDKITE_GIT_FETCH_FLAGS, BUILDKITE_GIT_MIRRORS_LOCK_TIMEOUT, BUILDKITE_GIT_MIRRORS_PATH, BUILDKITE_GIT_MIRRORS_SKIP_UPDATE, BUILDKITE_GIT_SUBMODULES
• Network variables (1): BUILDKITE_REQUEST_HEADER_BUILDKITE_PIPELINES_SHARD_ID

---

I decided against including the following:

Agent-Specific Variables (9):

• BUILDKITE_AGENT_PID - Agent process ID
• BUILDKITE_BUILD_PATH - Agent build directory
• BUILDKITE_SOCKETS_PATH - Agent sockets directory
• BUILDKITE_CONFIG_PATH - Agent config file path
• BUILDKITE_HOOKS_PATH - Agent hooks directory
• BUILDKITE_PLUGINS_PATH - Agent plugins directory
• BUILDKITE_BIN_PATH - Agent binary path
• BUILDKITE_BUILD_CHECKOUT_PATH - Agent-specific checkout path
• BUILDKITE_ENV_FILE - Env file path (agent-specific)
• BUILDKITE_ENV_JSON_FILE - JSON env file path

Security-Sensitive Variables (3):

• BUILDKITE_AGENT_ACCESS_TOKEN - Agent's access token
• BUILDKITE_AGENT_JOB_API_TOKEN - Job API token
• BUILDKITE_AGENT_JOB_API_SOCKET - Agent job API socket path

Agent Configuration Variables (10):

• BUILDKITE_AGENT_DEBUG - Agent debug mode
• BUILDKITE_AGENT_DEBUG_HTTP - Agent debug setting
• BUILDKITE_AGENT_DISABLE_WARNINGS_FOR - Agent warning config
• BUILDKITE_AGENT_ENDPOINT - Agent API endpoint
• BUILDKITE_AGENT_EXPERIMENT - Agent experimental features
• BUILDKITE_ADDITIONAL_HOOKS_PATHS - Agent hook paths

These 23 variables were excluded because they either:

1. Contain sensitive tokens/credentials that shouldn't be exposed to containers
2. Reference host filesystem paths that don't exist or aren't relevant inside containers
3. Control agent behavior rather than job execution context
4. Are internal agent state not needed for containerized job execution

The 32 included variables focus specifically on job execution context, build configuration, git operations, tracing, and pipeline signing - all directly relevant for containerized job execution while maintaining proper security boundaries.

[scadu]

Do we want to propagate variables like BUILDKITE_AGENT_JWKS_FILE, BUILDKITE_AGENT_JWKS_KEY_ID?