Function inject_identity_env_with_broker 

pub fn inject_identity_env_with_broker(
    wstore: Arc<WaveStore>,
    broker: Option<Arc<Broker>>,
    block_id: &str,
    env_vars: &mut HashMap<String, String>,
)

inject_identity_env + optional broker handle so the OAuth-class branch can publish identitybundlebindings:changed:<bundle_id> on a status change discovered by the expiry probe. The broker is Option<Arc<Broker>> — None (the legacy entry point, kept for test ergonomics) skips the publish; in production both call sites (app_api.rs AgentSendCommand + websocket.rs AgentInputCommand) pass Some(broker.clone()) so the IdentityManager’s bindings table flips its status badge without a reload. Per spec §4.4.