refactor(platforms): read host settings from HostEnvironment in platform and capture packages #3750

Part of #3747. Blocked by #3749.

Scope

• Packages: packages/platform-apple, platform-android, platform-linux, platform-vega, platform-harmonyos, react-native, capture-kit and provision-kit.
• Direct reads: DEVELOPER_DIR, ANDROID_HOME / ANDROID_SDK_ROOT, the HarmonyOS SDK paths, AGENT_DEVICE_IOS_*, AGENT_DEVICE_SWIFT_CACHE_DIR and PATH / PATHEXT.
• Calls and defaults: process.cwd(), and every env = process.env default parameter in these packages.

Required behavior

• Bound environment. Each read comes from the bound HostEnvironment. Behavior doesn't change.
• Apple runner. Its code receives configuration through its existing host port. R77 forbids direct host-kit value imports there (scripts/layering/apple-runner-host-port-policy.ts:43).
• Detached children (Apple runner processes, helpers) get an explicit spawn env and cwd. A child process can't receive a live JS host object.
• PNG worker (packages/capture-kit/src/png-worker-client.ts:113). It receives only the serializable configuration it needs, not the inherited worker env. Route process.emitWarning (:54) through the diagnostics sink.

Done when

• These packages' non-test sources contain no process.env or process.cwd().
• Apple and Android device verification passes for the runner, simulator and SDK-path changes, per docs/agents/device-verification.md.