Global agent env vars are silently dropped when the `launch` block is present

Severity: medium — silent, and the global config is the documented place for shared credentials.

crates/buzz-backend-kubernetes/src/env.rs:

if agent.launch.is_some() {
    env.extend(launch.env.clone());
} else {
    env.extend(agent.env_vars.clone());
}

The desktop always sends a launch block, so the top-level env_vars — which commands/agents_deploy.rs::build_deploy_payload fills with the merged global + persona + agent env — is ignored. A credential placed in the global agent config never reaches the pod, with no error anywhere.

Expected: either merge the top-level env_vars in both branches, or stop sending the merged map at the top level and put it only in launch.env.