Function inject_identity_env_async 

pub async fn inject_identity_env_async(
    mstore: Arc<Store>,
    id_store: Arc<Store>,
    identity_store: Arc<Store>,
    broker: Option<Arc<Broker>>,
    block_id: String,
    env_vars: HashMap<String, String>,
) -> Result<HashMap<String, String>, SpawnGateError>

The optional broker lets the OAuth-class branch publish identityaccounts:changed on a status change discovered by the expiry probe. None skips the publish; the agentinput turn (server/agent_handlers/input.rs) and agent.send (app_api/agent_io.rs) pass Some(broker.clone()) through build_persistent_spawn_env so any live account list flips its status badge without a reload. Per spec §4.4.

Async wrapper around inject_identity_env_with_broker for use from async spawn handlers. The underlying path does blocking I/O — synchronous SQLite reads and, for SecretRef::Keychain accounts, a blocking keyring (D-Bus Secret Service on Linux) read — so it runs on a blocking thread via spawn_blocking rather than stalling an async runtime worker. Takes ownership of env_vars and returns it with identity vars merged in.

Err(SpawnGateError) is the layer-3 spawn gate (see inject_identity_env): the caller must NOT spawn the CLI and must surface the error on the agent pane like any other spawn failure. A task-join failure also fails CLOSED (InjectionUnavailable, blocking the spawn) — see that variant’s doc for why an open fallback would systemically bypass the gate after any store panic.