I really don't think we should offer a "shadow environment"; that seems both like a trap for users (often not what they're actually looking for) and a suboptimal interface for things that are exclusively Rust. Working with Command but not the current process will work in some cases while surprising people in others, and it would also add complexity (what happens if the shadow environment and the real environment conflict).
As soon as #[deprecated_safe] is available, I think we should use that on the existing functions, and continue having that be our interface to the environment.
