feat(acp): Supervisor.Spawn extraEnv parameter

- extraEnv overrides agent_kinds.encrypted_env same-name keys (spec §6.1 #11)
- Prevents admin from hard-coding ACW_MCP_TOKEN in agent_kinds
- SessionService passes nil for now; system token wiring lands in I4
- BuildSpawnEnv exported for testing the override priority
- Fix app.go NewSupervisor call to match updated signature (from I5)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/app/app.go

@@ -333,7 +333,7 @@ func New(ctx context.Context, cfg *config.Config, dist embed.FS) (*App, error) {
 	acpProjAccess := acpProjectAccessAdapter{wsRepo: wsRepo, projectRepo: projectRepo}
 	acpSup := acp.NewSupervisor(
 		acpRepo, auditRec, notifyDispatcher,
-		wtSvc, wsRepo, enc,
+		wtSvc, wsRepo, nil, enc,
 		acp.SupervisorConfig{
 			SpawnTimeout:       cfg.Acp.SpawnTimeout,
 			KillGrace:          cfg.Acp.KillGrace,