Hide pyinstaller vendored libraries from subprocesses

[cbagwell]

openhands-agent-server is built from a different container image than its eventually installed into. This is resulting in a downgraded libstdc++ being used at runtime from LD_LIBRARY_PATH with C++ apps compiled using newer system libstdc++.

Summary

Request OpenHands to create, compile, and run a simple C++ and you will see an error similar to this because pyinstaller's LD_LIBRARY_PATH uses incompatible libstdc++ at runtime.

./helloworld: /tmp/_MEIOB99C3/libstdc++.so.6: version `GLIBCXX_3.4.32' not found (required by ./helloworld)
./helloworld: /tmp/_MEIOB99C3/libstdc++.so.6: version `CXXABI_1.3.15' not found (required by ./helloworld)
./helloworld: /tmp/_MEIOB99C3/libstdc++.so.6: version `GLIBCXX_3.4.29' not found (required by ./helloworld)

This uses pyinstallers suggested solution. The alternative is to use the more brittle work around of forcing the Dockerfile to use a compatible container when building. Or the usage of pyinstaller could be reconsidered.

Fixes: #1687

Checklist

• If the PR is changing/adding functionality, are there tests to reflect this?
• If there is an example, have you run the example to make sure that it works?
• If there are instructions on how to run the code, have you followed the instructions and made sure that it works?
• If the feature is significant enough to require documentation, is there a PR open on the OpenHands/docs repository with the same branch name?
• Is the github CI passing?

[all-hands-bot]

Testing line-specific comment

[all-hands-bot]

Test comment on env=sanitized_env(env) line

[all-hands-bot]

This PR addresses an important issue with PyInstaller vendored libraries conflicting with system libraries. The approach is sound, but I found one critical bug and several areas for improvement:

Critical Issues:

• In tmux_terminal.py line 62, the code still uses os.environ.items() to set session environment variables, which will pass PyInstaller's modified LD_LIBRARY_PATH to the tmux session. This defeats the purpose of the sanitization.

Additional Files Needing Updates:
For consistency, these files also spawn subprocesses with os.environ and should use sanitized_env():

• openhands-agent-server/openhands/agent_server/skills_service.py line 135
• openhands-sdk/openhands/sdk/hooks/executor.py line 53

Testing:
The PR checklist indicates no tests were added. While manual testing was done, consider adding a unit test for sanitized_env() to verify it correctly handles various scenarios.