Fixes #46775 -- don't mutate the process's environment in Command::exec

Fixes #46775 -- don't mutate the process's environment in Command::exec

Instead, pass the environment to execvpe, so the kernel can apply it directly to the new process. This avoids a use-after-free in the case where exec'ing the new process fails for any reason, as well as a race condition if there are other threads alive during the exec.