The CUA spawn-env tests froze PATH == '/usr/bin:/bin' verbatim. _sanitize_subprocess_env now (intentionally) prepends the hermes console-script dir for all sanitized children (#92998), so these assertions flip to the contract: original entries preserved as suffix, hermes bin dir first when prepended.