[codex] scope bridge terminal env refresh to worker startup (#1031)

* fix(bridge): refresh terminal env from profile config on profile switch

Profile switching changes HERMES_HOME but the TERMINAL_* environment
variables (TERMINAL_ENV, TERMINAL_SSH_HOST, etc.) still point to the
root config's terminal settings set at gateway startup.

Add _refresh_terminal_env() that re-reads terminal config from the
active profile's config.yaml and sets the corresponding TERMINAL_* env
vars. Call it in:
- AgentPool.get_or_create(): when creating a session for a profile
- AgentPool._run_chat(): before agent execution, inside _profile_env

Errors are handled gracefully: YAML parse failures log to stderr,
terminal_tool cache invalidation failures are silently ignored, and
missing config files are skipped without error.

* fix(bridge): refresh terminal env in worker profile setup

_set_worker_profile_env() handles broker-spawned worker subprocesses
that are isolated per profile. The worker inherits TERMINAL_* env vars
from the broker (root config), and _profile_env() is a no-op in worker
mode, so terminal config was never refreshed for non-default profiles.

Adding _refresh_terminal_env() here means each worker subprocess reads
its own profile's config.yaml terminal section on startup, solving
profile-isolated terminal backends (e.g. SSH per profile).

* fix bridge terminal env refresh scope

* refresh worker profile env for new agents

* avoid bridge worker restart for channel config

* align config controller bridge restart tests

---------

Co-authored-by: GoldenFish123321 <goldfishx@gmail.com>
Co-authored-by: GoldenFishX <golden_fish@foxmail.com>

tests/server/config-controller-file-lock.test.ts

@@ -74,7 +74,7 @@ describe('config controller locked file updates', () => {
 
     expect(ctx.body).toEqual({ success: true })
     expect(mockRestartGateway).toHaveBeenCalledWith('default')
-    expect(mockDestroyProfile).toHaveBeenCalledWith('default')
+    expect(mockDestroyProfile).not.toHaveBeenCalled()
     const config = YAML.load(await readFile(join(hermesHome, 'config.yaml'), 'utf-8')) as any
     expect(config.telegram.enabled).toBe(true)
     expect(config.telegram.extra).toEqual({ mode: 'old', token_mode: 'env' })
@@ -191,7 +191,7 @@ describe('config controller locked file updates', () => {
     }, 'research'))
 
     expect(mockRestartGateway).toHaveBeenCalledWith('research')
-    expect(mockDestroyProfile).toHaveBeenCalledWith('research')
+    expect(mockDestroyProfile).not.toHaveBeenCalled()
     const defaultConfig = YAML.load(await readFile(join(hermesHome, 'config.yaml'), 'utf-8')) as any
     const researchConfig = YAML.load(await readFile(join(researchDir, 'config.yaml'), 'utf-8')) as any
     expect(defaultConfig.telegram.require_mention).toBe(false)