codeSplitter checks: run as a sandbox user with no credentials, and pin what runs to settings #1010

From #1003, a gap in the "CI for your public repo, on your own machine" pitch (#978). Merged code is code that runs at home, so:

• Run checks (runner.ts and the desktop queue) with an empty HOME and a scrubbed environment, optionally as a separate OS user with no credentials.
• Add a setting that pins what runs to codeSplitter's settings, ignoring codesplitter.ci and package.json scripts at the ref, so a merged edit can't change the job that runs on your machine.

Related: #978, #1003, and the "sandbox untrusted repo runs" practice.