fix: support PAPERCLIP_DEV_API_KEY for external cancel polling

External cancel polling in execute.ts used PAPERCLIP_API_KEY which is
a short-lived run JWT for the main Paperclip instance. In multi-instance
setups (dev vs main), the agent runs on the dev instance but the run JWT
is only valid on the main instance, causing 401 on every poll.

Now polls with PAPERCLIP_DEV_API_KEY if set, falling back to
PAPERCLIP_API_KEY. The dev key is inherited through job-manifest.ts
from the pod's inherited env.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

src/server/job-manifest.ts

@@ -173,6 +173,12 @@ function buildEnvVars(
   if (selfPod.inheritedEnv.PAPERCLIP_API_URL) {
     paperclipEnv.PAPERCLIP_API_URL = selfPod.inheritedEnv.PAPERCLIP_API_URL;
   }
+  // Inherit PAPERCLIP_DEV_API_KEY if set (dev-instance key, distinct from the
+  // main-instance run JWT in PAPERCLIP_API_KEY). Used by the external cancel
+  // polling in execute.ts to authenticate against the dev Paperclip instance.
+  if (selfPod.inheritedEnv.PAPERCLIP_DEV_API_KEY) {
+    paperclipEnv.PAPERCLIP_DEV_API_KEY = selfPod.inheritedEnv.PAPERCLIP_DEV_API_KEY;
+  }
 
   // Layer 3: Inherited from Deployment (Bedrock, API keys, etc.)
   const merged: Record<string, string> = {