fix(export): sync successful exports when readonly args fail

[chaliy]

Motivation

• Recent readonly-error handling caused export to return nonzero for an operand and the interpreter to skip syncing all exported operands into self.env, so otherwise-valid NAME=VALUE operands in the same command were not visible to printenv/export -p despite being set in shell variables.

Description

• Update interpreter post-processing in crates/bashkit/src/interpreter/mod.rs to always perform export env sync for export and to skip only operands that are readonly by checking the _READONLY_<NAME> marker instead of gating on result.exit_code == 0.
• Add a targeted regression test export_continues_after_readonly_error_and_exports_good_args in crates/bashkit/tests/blackbox_security_tests.rs that asserts export LOCKED=skip GOOD=ok exits 1 and that GOOD is visible via printenv.
• Preserve the readonly error reporting in the export builtin implementation; this change only adjusts the interpreter-side env synchronization so Bash-compatible semantics are maintained.

Testing

• Ran cargo test -p bashkit --test blackbox_security_tests finding_readonly_bypass::export_continues_after_readonly_error_and_exports_good_args and the test passed (ok).
• The regression test verifies both the nonzero exit on readonly failure and that successful operands are exported to self.env and visible to printenv.

---

Codex Task

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	b07d3e8	Commit Preview URL	May 08 2026, 09:12 AM