fix(trust): Refuse to load from untrusted process.cwd() sources; Add tests (#7323)

packages/cli/src/config/settings.ts

@@ -556,6 +556,10 @@ export function setUpCloudShellEnvironment(envFilePath: string | null): void {
 export function loadEnvironment(settings: Settings): void {
   const envFilePath = findEnvFile(process.cwd());
 
+  if (!isWorkspaceTrusted(settings)) {
+    return;
+  }
+
   // Cloud Shell environment variable handling
   if (process.env['CLOUD_SHELL'] === 'true') {
     setUpCloudShellEnvironment(envFilePath);