fix: pass search env into Docker task containers (SEARXNG_URL was lost)

Docker tasks do not inherit the worker process environment, they only
get extra_env (-e). SEARXNG_URL in the worker unit EnvironmentFile
therefore never reached codex -> MCP inside the container, so the
auto chain skipped SearXNG and only DuckDuckGo was tried (live e2e:
'all search providers failed: duckduckgo (DNS)').

_docker_task_context now merges any set SEARXNG_URL /
PERPLEXITY_API_KEY / EXA_API_KEY / TAVILY_API_KEY / BRAVE_API_KEY
from the worker environment into extra_env (values never logged;
paid keys follow the same extra_env path as gateway keys).

Tests: 2 new docker-env tests; websearch + tenant isolation = 25
passing; full cloud suite 1038 passing (4 skipped).

cloud/worker.py

@@ -2200,6 +2200,20 @@ class Worker:
                 "NO_PROXY": "localhost,127.0.0.1",
                 "no_proxy": "localhost,127.0.0.1",
             }
+        # 搜索 env 透传：Docker 容器不继承 worker 进程环境，只拿
+        # extra_env（-e），所以 worker 环境里的搜索配置若不显式
+        # 放进这里，容器内 codex -> MCP 永远看不到 SEARXNG_URL，
+        # auto 链会跳过 SearXNG、只剩 DuckDuckGo（实弹 e2e 已证实）。
+        # 只透传已设置的项，值绝不进日志；付费 key 与网关 key 一样
+        # 走 extra_env（容器内进程本就需要它调 API）。
+        search_env = {
+            k: os.environ[k]
+            for k in ("SEARXNG_URL", "PERPLEXITY_API_KEY", "EXA_API_KEY",
+                      "TAVILY_API_KEY", "BRAVE_API_KEY")
+            if os.environ.get(k)
+        }
+        if search_env:
+            proxy_env = _merge_env(proxy_env, search_env)
         return (True, tenant_mounts, tenant_network, proxy_env, None)
 
     def _run_fork(self, task, quota_check=None):