coverage run breaks PYTHONSAFEPATH

[flying-sheep]

Describe the bug
When executing coverage run -m ... with the environment variable PYTHONSAFEPATH=1 set, the working directory appears in sys.path

To Reproduce

Create the following two files

printpath.py

import sys
import json

print(json.dumps(sys.path))

pyproject.toml

[build-system]
build-backend = "hatchling.build"
requires = ["hatchling"]

[project]
name = "printpath"
version = "0.0.1"
dependencies = ["coverage"]

[tool.hatch.envs.default]
dev-mode = false
[tool.hatch.envs.default.scripts]
printpath = ["PYTHONSAFEPATH=1 python -m printpath"]
printpath-cov = ["PYTHONSAFEPATH=1 coverage run -m printpath"]

then run

$ hatch run printpath
["/usr/lib/python311.zip", "/usr/lib/python3.11", "/usr/lib/python3.11/lib-dynload", "~/.local/share/hatch/env/virtual/printpath/1Fj_Wp0T/printpath/lib/python3.11/site-packages"]
$ hatch run printpath-cov
["~/Dev/Python/_reproducers/coverage-safepath", "/usr/lib/python3.11", "/usr/lib/python3.11/lib-dynload", "~/.local/share/hatch/env/virtual/printpath/1Fj_Wp0T/printpath/lib/python3.11/site-packages"]

Expected behavior
Both commands have the same output

[nedbat]

#1700 is a pull request in progress to fix this.