Merge pull request 'ci: harden soul-contract-gate boot for the Linux runner' (#85) from ci/harden-gate-boot into main

scripts/verify-soul-contract.sh

@@ -113,9 +113,16 @@ KNOWN_PENDING=(
 )
 
 # --- boot the soul -----------------------------------------------------------
+# Preserve the ambient environment (PATH, LD_LIBRARY_PATH, TMPDIR) so the
+# dynamically-linked soul finds its libs on any runner — using `env -i` here
+# stripped the library path on the Linux CI runner and the soul never booted.
+# Isolation is still guaranteed by UNSETTING the live-service vars (so it can
+# never reach the real engram/axon or make an LLM call) and by pointing HOME +
+# the snapshot at throwaway paths and the axon at a dead port.
 echo "== booting soul: $SOUL on port $PORT (throwaway HOME=$THROW_HOME) =="
-env -i \
-  PATH="/usr/bin:/bin:/usr/sbin:/sbin" \
+env \
+  -u ENGRAM_URL -u ENGRAM_API_KEY -u SOUL_ENGRAM_URL \
+  -u ANTHROPIC_API_KEY -u NEURON_LLM_API_KEY -u SOUL_IDENTITY \
   HOME="$THROW_HOME" \
   NEURON_PORT="$PORT" \
   SOUL_CGI_ID="ntn-contract-$$" \