fix(ito): allow coverage instrumentation on isolated env

scripts/ecc.js

@@ -233,9 +233,11 @@ function runCommand(commandName, args) {
     {
       cwd: process.cwd(),
       env: commandName === 'ito'
-        ? createSafeItoInvocationEnvironment(process.env, args, {
-          includeControls: true,
-        })
+        ? {
+          ...createSafeItoInvocationEnvironment(process.env, args, {
+            includeControls: true,
+          }),
+        }
         : process.env,
       encoding: 'utf8',
       maxBuffer: 10 * 1024 * 1024,

scripts/ito.js

@@ -257,7 +257,9 @@ function invokeIto(executable, args, environment = process.env) {
   const result = spawnSync(invocation.executable, invocation.args, {
     cwd: process.cwd(),
     encoding: "utf8",
-    env: createSafeItoInvocationEnvironment(environment, args),
+    // Keep policy helpers immutable for callers, but give child-process
+    // instrumentation its own mutable copy (for example NODE_V8_COVERAGE).
+    env: { ...createSafeItoInvocationEnvironment(environment, args) },
     maxBuffer: MAX_OUTPUT_BYTES,
     timeout: isNodeQualification ? NODE_QUALIFICATION_TIMEOUT_MS : undefined,
     shell: false,