_exec_buzz built the CLI env from os.environ.copy(), so every buzz call carried Hermes' gateway tokens and provider keys. It now starts from hermes_subprocess_env() and adds only the relay URL, key and auth tag.