fix: pass EJCLAW_HOST_IPC_DIR to MCP server env for both runners

Watcher tasks get task-scoped IPC dirs (data/ipc/{group}/tasks/{taskId}/),
but the MCP server used HOST_IPC_DIR to write IPC files. Without
EJCLAW_HOST_IPC_DIR, it fell back to the task-scoped path, writing
cancel_task/send_message files to nested dirs the IPC watcher never scans.

This caused 11 zombie watchers stuck in infinite loops — self-cancel
calls silently failed with ~4000 stranded IPC files accumulating.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

runners/agent-runner/src/index.ts

@@ -640,6 +640,12 @@ async function runQuery(
             EJCLAW_IS_MAIN: containerInput.isMain ? '1' : '0',
             EJCLAW_AGENT_TYPE:
               process.env.EJCLAW_AGENT_TYPE || 'claude-code',
+            ...(process.env.EJCLAW_IPC_DIR && {
+              EJCLAW_IPC_DIR: process.env.EJCLAW_IPC_DIR,
+            }),
+            ...(process.env.EJCLAW_HOST_IPC_DIR && {
+              EJCLAW_HOST_IPC_DIR: process.env.EJCLAW_HOST_IPC_DIR,
+            }),
           },
         },
         ...(process.env.MEMENTO_MCP_SSE_URL