Fixes #248.

Summary

• cao launch --env KEY=VALUE (repeatable) now forwards to both the supervisor terminal AND every worker spawned later in the same session via assign / handoff / the web UI.
• Validation runs at the CLI boundary (POSIX-name keys, blocked prefixes CLAUDE/CODEX_/__MISE_ with the six CLAUDE_CODE_USE_* / CLAUDE_CODE_SKIP_* auth flags allowlisted, 2048-byte value cap) so a bad entry fails fast instead of getting silently dropped server-side.
• Values travel in the JSON body of POST /sessions, not the URL — keeps anything resembling a secret out of cao-server's HTTP access log.

Why this matters

The strict tmux env allowlist from #246 keeps the tmux new-session -e argv under the kernel limit but also drops anything outside CAO_/KIRO_/MISE_/AWS_ prefixes. Operators reported that arbitrary deployment context they wanted on their agents (e.g. MNEMOSYNE_DIR, ISAAC_CHANNEL=room:engineering) was silently disappearing. --env is the explicit opt-out for that allowlist on a per-session basis.

The naive approach — only honour --env on the first agent — would have broken the multi-agent case where a supervisor's assign-spawned analysts still need the same context. This PR persists the mapping on a per-session in-memory record so create_window picks it up on every spawn automatically.

Architecture

• services/session_env.py — small thread-safe in-memory store (set / get / clear), held in cao-server's process. No schema migration; restarts wipe it.
• clients/tmux.py — create_session and create_window accept extra_env. New _merge_extra_env classmethod mirrors the same blocked-prefix / size-cap checks as the inherited-env filter, defending callers that bypass the CLI (cao-mcp-server, direct HTTP). Pre-existing constants extracted onto the class so both filters share them.
• services/terminal_service.py — create_terminal writes env_vars on new_session=True and looks up the persisted mapping on every spawn.
• services/session_service.py — create_session accepts env_vars; delete_session clears the mapping.
• api/main.py — POST /sessions accepts env_vars as an embedded JSON body field ({\"env_vars\": {...}}). Optional, so existing callers that send only query params remain compatible.
• cli/commands/launch.py — --env KEY=VALUE Click option, _parse_env_pairs validator, sends body only when at least one --env was provided.

Verification

$ cao launch --agents code_supervisor \
    --env MNEMOSYNE_DIR=/root/mnemosyne \
    --env ISAAC_CHANNEL=room:engineering
# supervisor terminal sees both vars ✓
# assign(data_analyst) → worker sees both vars ✓
# handoff(report_gen)  → worker sees both vars ✓

Bad inputs rejected at the CLI:

• --env CLAUDE_SESSION_ID=abc → --env key 'CLAUDE_SESSION_ID' uses a blocked prefix...
• --env 1FOO=bar → --env key must match [A-Za-z_][A-Za-z0-9_]* (got '1FOO')
• --env BIG=... (≥2048 bytes) → --env value for 'BIG' exceeds 2048 bytes (tmux argv limit, PR #246)

Test plan

• Run unit tests (uv run pytest test/cli/commands/test_launch.py test/services/test_session_env.py test/clients/test_tmux_merge_extra_env.py) — 58 passed locally.
• Black + isort clean on touched files.
• Manual launch with --env, verify the var appears in the supervisor's shell (env | grep … inside tmux attach).
• Manual assign from that supervisor to a worker; verify the worker's shell also sees the var.
• Manual launch with no --env to confirm POST /sessions still sends no body (regression guard for backward-compat callers).
• Verify a deliberately blocked prefix (--env CLAUDE_SESSION_ID=abc) errors at the CLI before any HTTP call is made.

Notes

Forwarded vars are process-local on cao-server and dropped on session delete; restarting cao-server wipes them. No on-disk format, no migration, and the issue explicitly accepts that scope.