fix(acp): wire BUZZ_PRIVATE_KEY and BUZZ_RELAY_URL into Hermes sessions

[Chessing234]

Summary

• Add Hermes-specific persona env injection for BUZZ_PRIVATE_KEY and BUZZ_RELAY_URL so managed Hermes sessions can authenticate Buzz CLI delivery.
• Force-apply those env vars when spawning the agent subprocess, even when the harness parent already exports its own copies.
• Add unit coverage for env assembly and spawn precedence.

Fixes #3768

Test plan

• cargo test -p buzz-acp hermes_buzz spawn_forces
• Launch a managed Hermes agent and confirm Buzz delivery succeeds without manual env injection

Made with Cursor

[Chessing234]

@tlongwell-block @wesbillman @wpfleger96 mind taking a look when you get a chance?