feat(google-calendar): encrypt chat tokens and give watchers a short-lived access token

token.json is sealed with AES-256-GCM (key derived from the OAuth client secret,
bound to the chat), so the agent's processes can read the file but not the
refresh token. Plain files, including VolcanicSecretary's refresh_token format,
are rewritten sealed on first read.

The scheduler gains IScriptEnvironment: extra per-run variables set after the
process environment filter and redacted from the run's output. The Telegram
host uses it to pass GOOGLE_ACCESS_TOKEN, refreshed to cover the job's timeout;
the refresh token and client secret never reach the script.

docs/telegram-bot.md

@@ -164,7 +164,9 @@ script itself, **without the agent**:
   Later identical failures stay quiet until the script succeeds again.
 
 Scripts run in the chat's workspace with the same filtered environment as `bash` and `TZ` set to the chat's zone.
-Known secrets are redacted from their output.
+When the chat has a connected Google Calendar they also get `GOOGLE_ACCESS_TOKEN`, a short-lived token for that
+calendar ([google-calendar.md](google-calendar.md#watcher-scripts)). Known secrets and that token are redacted from
+their output.
 
 When a job fires while the agent is working, a scheduled prompt waits until the current work is done; it never
 interrupts. Occurrences that come due while the same job is still running are skipped.