fix: unset PKG_EXECPATH and stale broker token vars in startup-cleanup

When startup-cleanup.sh runs mid-session (called by the control agent),
two inherited env vars cause bridge startup failures:

1. PKG_EXECPATH — leaked from the parent varlock-launched process, causes
   varlock's SEA binary to misinterpret subcommands as Node module paths.
   The varlock broker-key probes (lines 115-122) silently fail, resulting
   in 'No Slack transport configured' and the bridge never starting.

2. SLACK_BROKER_ACCESS_TOKEN / SLACK_BROKER_ACCESS_TOKEN_EXPIRES_AT —
   varlock does not override env vars already present in the parent
   process. If the broker token was rotated after session start, the
   supervisor passes the stale (expired) values instead of reading
   fresh ones from ~/.config/.env.

Fix: unset PKG_EXECPATH at script top (before varlock probes), and
unset broker token vars in the supervisor subshell (before varlock run).

Regression from #148.

Author: Baudbot

pi/skills/control-agent/startup-cleanup.sh

@@ -11,6 +11,11 @@
 
 set -euo pipefail
 
+# Prevent varlock SEA binary from misinterpreting argv when called from a
+# session that was itself launched via varlock (PKG_EXECPATH leaks into child
+# processes and causes `varlock run` to treat subcommands as Node module paths).
+unset PKG_EXECPATH 2>/dev/null || true
+
 BRIDGE_POLICY_HELPER="$HOME/runtime/bin/lib/bridge-restart-policy.sh"
 if [ -r "$BRIDGE_POLICY_HELPER" ]; then
   # shellcheck source=bin/lib/bridge-restart-policy.sh
@@ -140,6 +145,11 @@ echo "Starting slack-bridge ($BRIDGE_SCRIPT) with PI_SESSION_ID=$MY_UUID..."
 mkdir -p "$BRIDGE_LOG_DIR"
 (
   unset PKG_EXECPATH
+  # Clear stale broker token vars inherited from the parent session so that
+  # varlock injects the current values from ~/.config/.env instead of passing
+  # through an expired token/expiry from the original process environment.
+  unset SLACK_BROKER_ACCESS_TOKEN
+  unset SLACK_BROKER_ACCESS_TOKEN_EXPIRES_AT
   export PATH="$HOME/.varlock/bin:$HOME/opt/node/bin:$PATH"
   export PI_SESSION_ID="$MY_UUID"
   cd /opt/baudbot/current/slack-bridge