fix(dispatch): inject only apiKeyHelper instead of loading user settings

The prior fix loaded the whole user settings (--setting-sources user) to recover auth, then tried to suppress the unwanted parts. That still loaded user-level tool permissions: a user with permissions.defaultMode= bypassPermissions would let this internal --print call execute tool calls, and dispatch renders untrusted commit/branch text — a prompt-injection RCE path (trail #884 high-severity finding).

Redesign: keep the call fully isolated with --setting-sources "" (loads no hooks and no permissions) and inject ONLY the user's apiKeyHelper — extracted from ~/.claude/settings.json (honoring CLAUDE_CONFIG_DIR) — back via --settings. So API-billing auth works while user hooks and permissions are never loaded for this injection-exposed call. apiKeyHelper is a command reference, not the raw key, so it is safe to pass in argv; a raw key or the env block is deliberately not extracted.

Auth that does not live in user settings keeps working unchanged: an exported ANTHROPIC_API_KEY (preserved by StripGitEnv) and keychain/subscription creds.

Verified end-to-end via dispatch --local: apiKeyHelper user authenticates with no hooks firing and permissions not loaded; real subscription still generates a dispatch; ANTHROPIC_API_KEY env var still works; a truly unauthenticated user still gets "Not logged in". Adds arg-builder and settings-reader unit tests.

Addresses trail #884 review findings.