feat(desktop): per-persona and per-agent env var overrides

[tlongwell-block]

What

Adds per-persona and per-agent env var overrides to the desktop GUI. Personas and managed agents each carry a BTreeMap<String, String> of env vars that get layered into the spawned agent's environment.

Precedence (last wins): desktop parent env < persona env < agent env.

A small set of reserved keys — Sprout's identity and secrets — are rejected at save time and stripped at runtime so a typo or malicious value can't swap the agent's nsec.

Why

Users want to set provider credentials (ANTHROPIC_API_KEY, OPENAI_API_KEY), provider selection (GOOSE_PROVIDER), local-LLM endpoints (OPENAI_BASE_URL), etc. without editing shell rc files. Per-persona keys cover the common case; per-agent overrides handle the "one-off agent on a different model" case.

Surface area

Backend (Rust):

• managed_agents/env_vars.rs — new module with merged_user_env, RESERVED_ENV_KEYS, is_reserved_env_key, validate_user_env_keys + 16 unit tests.
• managed_agents/runtime.rs — merges persona env → agent env, calls into env_vars::merged_user_env at spawn.
• managed_agents/types.rs — env_vars field on PersonaRecord and ManagedAgentRecord.
• commands/personas.rs, commands/agents.rs, commands/agent_models.rs — validate_user_env_keys at save time; merged_user_env also used by sprout-acp models discovery and provider deploy so credentials in persona env flow into both.

Frontend (TS):

• features/agents/ui/EnvVarsEditor.tsx — new shared component (key/value rows, add/remove, validation hint).
• features/agents/ui/PersonaDialog.tsx, CreateAgentDialog.tsx, EditAgentDialog.tsx — embed the editor; persona env shown read-only when editing an agent, with per-agent overrides on top.
• shared/api/types.ts, tauri.ts, tauriPersonas.ts — envVars field on create/update payloads, with the convention that envVars: undefined on update = "don't touch" (so editing unrelated fields can't wipe saved credentials).

Reserved keys

Key	Why
SPROUT_PRIVATE_KEY	Agent's nsec — overriding swaps identity
NOSTR_PRIVATE_KEY	Mirror of above for git-credential-nostr
SPROUT_AUTH_TAG	NIP-OA auth tag — overriding breaks relay auth
SPROUT_API_TOKEN	Reserved for future server auth
SPROUT_ACP_PRIVATE_KEY	Legacy alias for SPROUT_PRIVATE_KEY
SPROUT_ACP_API_TOKEN	Legacy alias for SPROUT_API_TOKEN

Behavior knobs (GOOSE_MODE, SPROUT_TOOLSETS, SPROUT_ACP_MODEL, SPROUT_ACP_SYSTEM_PROMPT, etc.) remain freely overridable — those have dedicated UI fields, but power users may want to bypass them.

Two-layer enforcement:

1. Save-time — validate_user_env_keys rejects reserved keys with a clear error like the following env vars are reserved by Sprout and cannot be overridden: SPROUT_PRIVATE_KEY, surfaced in the dialog.
2. Runtime — merged_user_env strips reserved keys with a warning log. Defense in depth for older on-disk records that predate validation.

Case-insensitive match so sprout_private_key is also rejected — Unix env vars are case-sensitive at the syscall level, but lowercase variants of these specific keys are almost certainly typos.

Tests

• 16 unit tests in env_vars.rs cover the merge order, the reserved-key filter, and the validator.
• 1 e2e test (desktop/tests/e2e/persona-env-vars.spec.ts) drives the EnvVarsEditor through the Persona dialog.
• All 291 desktop crate unit tests pass. cargo fmt, biome check, pnpm typecheck, cargo clippy all clean.

Review history

Codex reviewed five times across the branch lifecycle:

• R1: caught HIGH (runtime merge order — sort of, see note), HIGH (None=clear semantics — withdrew that design, simpler last-wins), MED (model discovery wouldn't see persona env — fixed), MED (summary plumbing — fixed).
• R2: dialog state clear/preserve nits.
• R3: edit-dialog initial-state seeding.
• R4: aborted (pre-fix codex timeout).
• R5: clean — "The changes compile and typecheck, and the new env var data flow appears consistent across persona/agent storage, UI editing, local spawn, model discovery, and provider deploy paths. I did not find any discrete correctness issues introduced by this patch." + one lint nit (hasOwnProperty → in), fixed.

The final fix in this PR (reserved-key denylist) closes a footgun I called out in self-review but the earlier passes didn't flag: user env was written LAST during spawn, so a GUI typo of SPROUT_PRIVATE_KEY would have swapped the agent's identity at runtime. The "no allow-list, by design" comment was wrong on its own terms — fixed.

Supersedes

#576 (already closed).