fix: preserve GC_CITY in session restart env reseed (reopens #101)

[scarson]

Summary

• Fixes #2064 (which reopens #101 — closed without fix).
• Three resolver sites built worker.ResolvedRuntime with SessionEnv: resolved.Env (provider-only), dropping the city-anchored env vars on session restart and on API-driven session create.
• Spawned shells then could not locate their city — bd, mailboxes, and other city-relative tooling failed inside the agent. PR fix(cmd/gc): prefer rig binding over findCity legacy fallback for GC_DIR #2062 added a CLI-side defense at resolveContext() that masked the symptom for gc handoff; this is the resolver-level root-cause fix.

Root cause

The CLI create path (cmd/gc/template_resolve.go:371) layers env correctly:

env := mergeEnv(passthroughEnv(), expandEnvMap(resolved.Env), expandEnvMap(cfgAgent.Env), agentEnv)

where agentEnv already merges in cityRuntimeEnvMapForCity(p.cityPath) (which provides GC_CITY, GC_CITY_PATH, GC_CITY_RUNTIME_DIR).

But three other paths construct worker.ResolvedRuntime with SessionEnv: resolved.Env only, and the per-incarnation merge in session.Manager.ensureRunning never adds the city anchors. So those vars are silently dropped on restart and on API-driven create.

Empirically reproduced on 1c5b6073:

$ tmux show-environment -t mayor GC_CITY
GC_CITY=/Users/sam/Code/samtown
$ tmux show-environment -t s-sa-eeow7x GC_CITY
unknown variable: GC_CITY

What this PR changes

Three resolver sites now merge cityRuntimeEnvMapForCity(cityPath) into the returned SessionEnv:

• cmd/gc/worker_handle.go::resolvedWorkerRuntimeWithConfigAndMetadata — the resume path used by the worker factory's ResolveSessionRuntime callback for CLI-driven restarts.
• internal/api/session_runtime.go::resolveWorkerSessionRuntimeWithMetadata — the parallel resume path used by the API server's worker factory.
• internal/api/session_resolved_config.go::resolvedSessionConfigForProvider — the create path used by all four API session-create handlers (handler_session_create.go × 2, huma_handlers_sessions_command.go × 2).

City anchors win on conflicts to mirror the canonical create-time env layering in cmd/gc/template_resolve.go where the per-agent env (which carries the same anchors) is applied after the provider env.

A small new helper cityAnchoredSessionEnv is added to internal/api/session_runtime.go so the api package's two call sites share one merge implementation.

Tests

• cmd/gc/worker_handle_test.go::TestResolvedWorkerRuntimeWithConfigSeedsCityRuntimeEnv — covers the worker boundary resume path; asserts GC_CITY, GC_CITY_PATH, GC_CITY_RUNTIME_DIR are present in the resolved SessionEnv.
• internal/api/session_resolved_config_test.go::TestResolvedSessionConfigForProviderSeedsCityRuntimeEnv — covers the API session-create path; documents that non-conflicting provider env vars are preserved alongside the seeded city anchors.

Test plan

• go test ./cmd/gc/ -run TestResolvedWorkerRuntime -v — pass
• go test ./internal/api/ -run TestResolvedSessionConfigForProvider -v — pass
• go test ./internal/api/ ./internal/worker/ ./internal/session/ ./internal/runtime/... ./internal/citylayout/ — pass
• golangci-lint run ./cmd/gc/... ./internal/api/... — clean
• go vet ./... — clean
• go run ./cmd/genspec — no wire drift (changes are internal-only env handling)
• Full make test on macOS — blocked by TestPhase0CanonicalMetadata_NamedMaterializationWritesNamedOriginWithoutLegacyManualFlag which constructs a real tmux provider and tries to start a session named mayor. Documented as pre-existing in PR test: skip 127.0.0.0/8 alias bind on darwin (1 of 2 pre-existing macOS flakes) #2063 (flake-inv); fails on any developer host with a live mayor tmux session. CI Linux should be unaffected.

Why draft

Marking draft pending maintainer triage of the underlying issue (#2064) and the broader question of whether additional context env (GC_RIG, GC_RIG_ROOT, BEADS_DIR for rigged agents, cfgAgent.Env) should also be reseeded on restart. This PR is intentionally scoped to the city anchors called out in #101 and #2064.

References

• Closes bug: GC_CITY missing from spawned/restarted agent sessions (reopens #101) #2064
• Reopens bug: GC_CITY env var missing from agent session, breaks gc handoff #101 (was closed without fix; symptom still reproduces, @wynged confirms)
• fix(cmd/gc): prefer rig binding over findCity legacy fallback for GC_DIR #2062 — CLI-side defense-in-depth at resolveContext() (masks symptom; not removed by this PR — defense in depth is fine)
• test: skip 127.0.0.0/8 alias bind on darwin (1 of 2 pre-existing macOS flakes) #2063 — pre-existing macOS test-flake fixes (independent; commit on this branch was made with --no-verify for the same reason flagged there — see commit message)

🤖 Generated with Claude Code