cli: audit remaining flag exports leaking into nested bashunit runs

[Chemaclass]

Context

#835 fixed five run-mode flags (--stop-on-failure, --log-junit, --report-html, --report-tap, --report-json) that were exported by src/main.sh's flag parser and therefore leaked into nested bashunit runs — a script under test that itself calls bashunit, or bashunit's own acceptance suite under build.sh --verify. The observed damage there: nested runs aborted before persisting the rerun cache, overwrote the parent's report files, and blew the per-run awk fork budget.

src/main.sh still has ~40 more export BASHUNIT_* sites in the same flag-parsing loop (grep -c 'export BASHUNIT_' src/main.sh), all of the same class: --parallel, --filter, --no-output, --simple, --verbose, shard vars, etc. Any of them changes the behavior of a nested bashunit invocation the user did not configure.

Task

Audit every export BASHUNIT_* in src/main.sh and convert this-process-only flags to the #835 pattern:

BASHUNIT_FOO=value
export -n BASHUNIT_FOO

The export -n matters: a set -o allexport .env load (env.sh:65) stamps the export attribute on every var listed in .env, so a plain unexported assignment is not enough for anyone whose .env was copied from .env.example (which lists every var). CI has no .env, dev repos usually do — behaviors diverge exactly as they did in #835.

Audit rules (per flag, don't blanket-strip)

Keep the export only when a process other than the main bashunit shell genuinely reads the variable via the environment:

• Parallel workers and test bodies are subshells — they inherit unexported vars; export is never needed for them
• Export is only meaningful for exec'd children: nested bashunit, user commands run by tests, bootstrap scripts
• Suspected legitimate exports (verify before keeping): BASHUNIT_SHARD_INDEX/BASHUNIT_SHARD_TOTAL if any child consumes them; anything documented as readable by user test code
• When in doubt, strip: the user can always export explicitly; the framework silently reconfiguring nested runs is the bug

Acceptance criteria

• Every export BASHUNIT_* in src/main.sh either converted to assign+export -n or annotated with a one-line comment naming the exec'd consumer that needs it
• tests/acceptance/fixtures/flag_env_leak/leak_probe.sh extended to assert the full converted flag list is absent from a nested run's environment (the existing bashunit_flag_env_leak_test.sh shows the pattern)
• Env-var configuration still works: BASHUNIT_PARALLEL_RUN=true ./bashunit tests/ etc. must behave as before (env.sh := chain reads inherited values — only the flag→export direction changes)
• ./build.sh --verify green (the strictest nested-run consumer)
• Snapshot tests unchanged — some snapshots embed env-dependent output; run ./bashunit tests/acceptance/ early

Constraints

• Bash 3.0+ (export -n is fine on 3.x)
• One PR; this is a single mechanical audit, not per-flag PRs
• TDD: extend the leak probe first (RED against current main), then convert

Verification

./bashunit tests/ && ./bashunit --parallel --simple --strict tests/
make sa && make lint
./build.sh --verify

[Chemaclass]

Done in #839 (merged). All ~40 flag sites converted to assign + export -n; leak probe covers 15 flag/probe pairs; audited every reader — no exec'd consumer exists.