Function inject_identity_env_async 

pub async fn inject_identity_env_async(
    wstore: Arc<Store>,
    broker: Option<Arc<Broker>>,
    block_id: String,
    env_vars: HashMap<String, String>,
) -> HashMap<String, String>

inject_identity_env + optional broker handle so the OAuth-class branch can publish identitybundlebindings:changed:<bundle_id> on a status change discovered by the expiry probe. The broker is Option<Arc<Broker>> — None (the legacy entry point, kept for test ergonomics) skips the publish; in production both call sites (app_api.rs AgentSendCommand + websocket.rs AgentInputCommand) pass Some(broker.clone()) so the IdentityManager’s bindings table flips its status badge without a reload. Per spec §4.4. Async wrapper around inject_identity_env_with_broker for use from async spawn handlers. The underlying path does blocking I/O — synchronous SQLite reads and, for SecretRef::Keychain accounts, a blocking keyring (D-Bus Secret Service on Linux) read — so it runs on a blocking thread via spawn_blocking rather than stalling an async runtime worker. Takes ownership of env_vars and returns it with identity vars merged in. On the rare task-join failure the original map is returned unchanged so the static cmd:env vars are never lost. See spec §12.2.