Stop agents from debugging env vars on every heartbeat

Added explicit directive to all heartbeats: PAPERCLIP_API_KEY and other
env vars are pre-injected and valid — do not inspect, decode, verify,
or debug them. Exit cleanly on 401 instead of retrying.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

ceo/HEARTBEAT.md

@@ -4,6 +4,8 @@
 
 Do these steps in order. Do not skip any. Do not ask for input.
 
+> **Environment variables** (`PAPERCLIP_API_KEY`, `PAPERCLIP_API_URL`, `PAPERCLIP_RUN_ID`, `PAPERCLIP_AGENT_ID`, `PAPERCLIP_COMPANY_ID`) are pre-injected and valid for this run. **Do NOT inspect, decode, verify, or debug them.** Use them directly in commands. If an API call returns 401, the run token has expired — exit the heartbeat cleanly instead of retrying or debugging.
+
 ### 1. Load your operating context
 
 Read the Paperclip skill to understand how to interact with this system:

cmo/HEARTBEAT.md

@@ -4,6 +4,8 @@
 
 Do these steps in order. Do not skip any. Do not ask for input.
 
+> **Environment variables** (`PAPERCLIP_API_KEY`, `PAPERCLIP_API_URL`, `PAPERCLIP_RUN_ID`, `PAPERCLIP_AGENT_ID`, `PAPERCLIP_COMPANY_ID`) are pre-injected and valid for this run. **Do NOT inspect, decode, verify, or debug them.** Use them directly in commands. If an API call returns 401, the run token has expired — exit the heartbeat cleanly instead of retrying or debugging.
+
 ### 0. Authenticate with GitHub
 
     export GH_TOKEN=$(bash /paperclip/privilegedescalation/agents/get-github-token.sh)

cto/HEARTBEAT.md

@@ -4,6 +4,8 @@
 
 Do these steps in order. Do not skip any. Do not ask for input.
 
+> **Environment variables** (`PAPERCLIP_API_KEY`, `PAPERCLIP_API_URL`, `PAPERCLIP_RUN_ID`, `PAPERCLIP_AGENT_ID`, `PAPERCLIP_COMPANY_ID`) are pre-injected and valid for this run. **Do NOT inspect, decode, verify, or debug them.** Use them directly in commands. If an API call returns 401, the run token has expired — exit the heartbeat cleanly instead of retrying or debugging.
+
 ### 0. Authenticate with GitHub
 
     export GH_TOKEN=$(bash /paperclip/privilegedescalation/agents/get-github-token.sh)

engineering/gandalf/HEARTBEAT.md

@@ -4,6 +4,8 @@
 
 Do these steps in order. Do not skip any. Do not ask for input.
 
+> **Environment variables** (`PAPERCLIP_API_KEY`, `PAPERCLIP_API_URL`, `PAPERCLIP_RUN_ID`, `PAPERCLIP_AGENT_ID`, `PAPERCLIP_COMPANY_ID`) are pre-injected and valid for this run. **Do NOT inspect, decode, verify, or debug them.** Use them directly in commands. If an API call returns 401, the run token has expired — exit the heartbeat cleanly instead of retrying or debugging.
+
 ### 0. Authenticate with GitHub
 
     export GH_TOKEN=$(bash /paperclip/privilegedescalation/agents/get-github-token.sh)

engineering/hugh/HEARTBEAT.md

@@ -4,6 +4,8 @@
 
 Do these steps in order. Do not skip any. Do not ask for input.
 
+> **Environment variables** (`PAPERCLIP_API_KEY`, `PAPERCLIP_API_URL`, `PAPERCLIP_RUN_ID`, `PAPERCLIP_AGENT_ID`, `PAPERCLIP_COMPANY_ID`) are pre-injected and valid for this run. **Do NOT inspect, decode, verify, or debug them.** Use them directly in commands. If an API call returns 401, the run token has expired — exit the heartbeat cleanly instead of retrying or debugging.
+
 ### 0. Authenticate with GitHub
 
     export GH_TOKEN=$(bash /paperclip/privilegedescalation/agents/get-github-token.sh)

engineering/regina/HEARTBEAT.md

@@ -4,6 +4,8 @@
 
 Do these steps in order. Do not skip any. Do not ask for input.
 
+> **Environment variables** (`PAPERCLIP_API_KEY`, `PAPERCLIP_API_URL`, `PAPERCLIP_RUN_ID`, `PAPERCLIP_AGENT_ID`, `PAPERCLIP_COMPANY_ID`) are pre-injected and valid for this run. **Do NOT inspect, decode, verify, or debug them.** Use them directly in commands. If an API call returns 401, the run token has expired — exit the heartbeat cleanly instead of retrying or debugging.
+
 ### 0. Authenticate with GitHub
 
     export GH_TOKEN=$(bash /paperclip/privilegedescalation/agents/get-github-token.sh)

marketing/samuel/HEARTBEAT.md

@@ -4,6 +4,8 @@
 
 Do these steps in order. Do not skip any. Do not ask for input.
 
+> **Environment variables** (`PAPERCLIP_API_KEY`, `PAPERCLIP_API_URL`, `PAPERCLIP_RUN_ID`, `PAPERCLIP_AGENT_ID`, `PAPERCLIP_COMPANY_ID`) are pre-injected and valid for this run. **Do NOT inspect, decode, verify, or debug them.** Use them directly in commands. If an API call returns 401, the run token has expired — exit the heartbeat cleanly instead of retrying or debugging.
+
 ### 0. Authenticate with GitHub
 
     export GH_TOKEN=$(bash /paperclip/privilegedescalation/agents/get-github-token.sh)