Wire the layered Python environment into service startup

Why: The dependency layer already existed in the backend, but service startup never passed it, so the sandbox could not import the packages the host already had.
Evidence: SELF go tests recorded on the backend commit. svc.sh only exports the env root after env ensure leaves a current base layer, and a failed download does not block startup.
Impact: Instances share runtime/envs. Existing exec= lines are left as stored. Proposal, backend, and frontend gitlinks move to this branch.
Refs: .task/feature-layered-python-env.md
Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/svc.sh

@@ -3948,6 +3948,29 @@ agent_static_preflight() {
   return 0
 }
 
+# agent_exec_env_prepare：多个实例共用 runtime/envs。产物认识 env 子命令时先 ensure。
+# 下载失败只警告。current 基础层存在时，经环境变量把根和依赖层交给 serve，
+# 不改写已经持久化的 exec=。
+agent_exec_env_prepare() {
+  local probe root id deps
+  probe="$("$ENV_BIN" env 2>&1 || true)"
+  case "$probe" in
+    *ensure*) ;;
+    *) return 0 ;;
+  esac
+  root="$RUNTIME/envs"
+  if ! "$ENV_BIN" env ensure --root "$root"; then
+    c_warn "[$ENV_NAME] Python 环境根未就绪（$root）。启动继续，基础层导入不可用，直到 env ensure 成功。"
+  fi
+  [ -L "$root/current" ] || return 0
+  id="$(basename "$(readlink "$root/current")")"
+  deps="$root/layers/$id/site-packages"
+  [ -d "$deps" ] || return 0
+  guard_env+=("AGENT_SYSTEM_EXEC_ENV_ROOT=$root")
+  guard_env+=("AGENT_SYSTEM_EXEC_DEPS_DIR=$deps")
+  c_info "[$ENV_NAME] Python 环境：$root （基础层 $id）"
+}
+
 agent_do_start() {
   mkdir -p "$ENV_DATA" "$ENV_DIR"
   check_port_free || return 1
@@ -4043,6 +4066,7 @@ agent_do_start() {
     guard_env+=("AGENT_SYSTEM_INSTANCE_ID=$AGENT_SYSTEM_INSTANCE_ID")
     guard_env+=("AGENT_SYSTEM_DBREF=${AGENT_SYSTEM_DBREF:-sqlite}")
   fi
+  agent_exec_env_prepare
   # 9>&-：显式关闭锁 fd——服务进程绝不能继承 .start.lock（长驻持有会令后续
   # 生命周期操作在锁上自锁死等；2026-10-11 自恢复任务实测发现）。
   svc_write_serve_env