feat(acp): Supervisor.Spawn extraEnv parameter

- extraEnv overrides agent_kinds.encrypted_env same-name keys (spec §6.1 #11)
- Prevents admin from hard-coding ACW_MCP_TOKEN in agent_kinds
- SessionService passes nil for now; system token wiring lands in I4
- BuildSpawnEnv exported for testing the override priority
- Fix app.go NewSupervisor call to match updated signature (from I5)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/acp/session_service.go

@@ -219,7 +219,7 @@ func (s *sessionService) Create(ctx context.Context, c Caller, in CreateSessionI
 	go func() {
 		spawnCtx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
 		defer cancel()
-		if _, err := s.sup.Spawn(spawnCtx, out, kind); err != nil {
+		if _, err := s.sup.Spawn(spawnCtx, out, kind, nil); err != nil {
 			s.releaseOnFailure(spawnCtx, out, sessCaller, worktreeID)
 		}
 	}()