fix: support PAPERCLIP_DEV_API_KEY for external cancel polling

External cancel polling in execute.ts used PAPERCLIP_API_KEY which is
a short-lived run JWT for the main Paperclip instance. In multi-instance
setups (dev vs main), the agent runs on the dev instance but the run JWT
is only valid on the main instance, causing 401 on every poll.

Now polls with PAPERCLIP_DEV_API_KEY if set, falling back to
PAPERCLIP_API_KEY. The dev key is inherited through job-manifest.ts
from the pod's inherited env.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

src/server/execute.ts

@@ -544,8 +544,11 @@ async function streamAndAwaitJob(
         await new Promise<void>((resolve) => setTimeout(resolve, KEEPALIVE_INTERVAL_MS));
         if (logStopSignal.stopped || cancelSignal.cancelled) break;
         try {
+          // Prefer PAPERCLIP_DEV_API_KEY if set (allows dev instance key to be
+          // distinct from the main-instance run JWT in PAPERCLIP_API_KEY).
+          const apiKey = process.env.PAPERCLIP_DEV_API_KEY ?? process.env.PAPERCLIP_API_KEY ?? "";
           const resp = await fetch(`${apiUrl}/api/issues/${issueId}`, {
-            headers: { Authorization: `Bearer ${process.env.PAPERCLIP_API_KEY ?? ""}` },
+            headers: { Authorization: `Bearer ${apiKey}` },
           });
           if (resp.ok) {
             const data = await resp.json() as { status?: string };

src/server/job-manifest.ts

@@ -173,6 +173,12 @@ function buildEnvVars(
   if (selfPod.inheritedEnv.PAPERCLIP_API_URL) {
     paperclipEnv.PAPERCLIP_API_URL = selfPod.inheritedEnv.PAPERCLIP_API_URL;
   }
+  // Inherit PAPERCLIP_DEV_API_KEY if set (dev-instance key, distinct from the
+  // main-instance run JWT in PAPERCLIP_API_KEY). Used by the external cancel
+  // polling in execute.ts to authenticate against the dev Paperclip instance.
+  if (selfPod.inheritedEnv.PAPERCLIP_DEV_API_KEY) {
+    paperclipEnv.PAPERCLIP_DEV_API_KEY = selfPod.inheritedEnv.PAPERCLIP_DEV_API_KEY;
+  }
 
   // Layer 3: Inherited from Deployment (Bedrock, API keys, etc.)
   const merged: Record<string, string> = {