worker-host upgrade: drop the persisted WORKER_ENGINE=codex from ~/.env and ~/runner/.env

[SSFSKIM]

Problem & intent

PR #35 removed WORKER_ENGINE=codex from infra/worker-host/env.example so a
freshly provisioned worker host picks up the new claude default for label-less
implement/spike tickets. That does nothing for hosts already seeded from the
previous template: env.example is a template, and the live values are
persistent layer-3 state on the data volume.

Two files on such a host still carry the old override, and both outrank the new
fallback:

• /data/worker/.env — sourced by ~/.bashrc under set -a, so it reaches
  every sweep tick and every manual dispatch.
• /data/worker/runner/.env — a separate copy made by
  infra/worker-host/README.md §2.6 (grep -Ev '^\s*(#|$)' ~/.env > ~/runner/.env), read by Actions runner jobs, which do NOT read .bashrc.

Until both are edited, an upgraded host keeps routing unlabeled implement
tickets through the clodex gateway — i.e. ticket #33's success criterion holds in
the repo but not on the machine. The runner also needs a restart to pick up a
changed ~/runner/.env.

Raised by the review engine on PR #35 (round 3, P2) and routed here by the review
worker: PR #35 was already at its fix-wave cap, and the remaining work is partly
an operator action on a host the reviewer cannot reach.

Not verified on a live host — there is no /data/worker/.env or ~/.env on the
Mac this review ran on, so whether any currently-provisioned body carries the key
is for the human to confirm.

Constraints

• Do not re-add the key anywhere. The per-lane defaults are the design now
  (implement + spike → claude; review + land → codex, each via their own
  ${WORKER_ENGINE:-…} fallback).
• The runner env is a copy, not a symlink — fixing only ~/.env leaves
  event-triggered dispatches on the old route. Both files, then restart the
  runner service.
• Layer-3 state is deliberately volume-persistent (see README §4, the rebuild
  drill), so this cannot be solved by re-running cloud-init.

Success criteria

• infra/worker-host/README.md carries an upgrade note telling an operator with
  an existing body exactly what to remove and that the runner must be restarted —
  placed where an upgrader will actually look (§4's rebuild drill is the natural
  home, since that section is already about what survives a rebuild).
• On any provisioned host, grep WORKER_ENGINE ~/.env ~/runner/.env returns
  nothing, and a label-less implement dispatch from that host spawns a
  plain-Claude worker.

Open questions

• Worth a general "upgrading an existing body" section rather than a one-off note?
  This is the first change that mutates already-seeded layer-3 state, so it will
  not be the last — a standing section may pay for itself. Recommend: write the
  one-off note now (cheap, unblocks this change), and only generalize when a
  second instance appears.

Decision log

• Split off PR feat(implement): default model route flips clodex → claude (C6) #35 rather than fixed in it: feat(implement): default model route flips clodex → claude (C6) #35 had used both of its fix waves,
  and the host-side half is an operator action, not a diff.