research_container: propagate ZAI_ + KIMI_ env into per-team runtime

Shared runtime's config points several providers at Z.AI's Anthropic
proxy (`ANTHROPIC_AUTH_TOKEN = \"\$ZAI_API_KEY\"`) and the Kimi
provider block needs KIMI_API_KEY. inherited_env only propagated
ZEROCLAW_/OPENAI_/ANTHROPIC_/GEMINI_/GROQ_ prefixes — ZAI_ and KIMI_
were silently dropped, so per-team daemons booted with empty
substitutions and every Z.AI-routed call died with 'LLM request
failed' (500 from the daemon, executor timeout at 300s).

Adds both to the prefix allowlist. Server container already has
ZAI_API_KEY set from the compose env_file; KIMI_ will flow through
too when we add it.

Doesn't fully close today's incident — the current stuck run's
webhook still 500s even with ZAI_API_KEY injected, so there's a
second daemon-internal issue (need to boot the team daemon with
--verbose to surface it). But the propagation fix is a real bug on
its own and would silently break the moment the workspace's
configured role calls into a ZAI-routed provider.

crates/cm-api/src/research_container.rs

@@ -139,7 +139,22 @@ pub fn connect() -> Result<Docker, String> {
 /// team runtime — provider config, tokens, gateway port. Filtered by
 /// prefix so we don't drag `PATH`, `HOME`, unrelated secrets, etc.
 fn inherited_env() -> Vec<String> {
-    const PREFIXES: &[&str] = &["ZEROCLAW_", "OPENAI_", "ANTHROPIC_", "GEMINI_", "GROQ_"];
+    // ZAI_ + KIMI_ added 2026-07-11 — the shared runtime's templated
+    // config points several providers at Z.AI's Anthropic proxy
+    // (`ANTHROPIC_AUTH_TOKEN = "$ZAI_API_KEY"`) and Kimi's cli
+    // provider needs KIMI_API_KEY. Without these, the daemon
+    // substitutes empty strings and every LLM call fails with
+    // "LLM request failed" — the executor then times out at 300s
+    // with no events written.
+    const PREFIXES: &[&str] = &[
+        "ZEROCLAW_",
+        "OPENAI_",
+        "ANTHROPIC_",
+        "GEMINI_",
+        "GROQ_",
+        "ZAI_",
+        "KIMI_",
+    ];
     let mut out = Vec::new();
     for (k, v) in std::env::vars() {
         if PREFIXES.iter().any(|p| k.starts_with(p)) {