The compute host runs dashboard agent turns, so it is Hermes itself, not
a third-party child: the os.environ layer is deliberate (#65895). Without
it, keys that exist only in the process env (Docker -e, systemd,
launchd) were gone from turns: HASS_TOKEN (Home Assistant tools),
MODAL_TOKEN_ID / DAYTONA_API_KEY (those terminal backends), auxiliary
keys and platform send tokens, and HOME was rewritten in containers. The
.env ones came straight back anyway, since the host reloads .env at
start. Restore the layer and allowlist the file in the spawn-env guard.
b9c2cc925f