fix(daemon): give claude-ops-daemon the gog file-keyring env so memory-extractor can read email

The memory-extractor service shells out to `gog gmail search` to collect
recent email for memory extraction. gog stores its Gmail OAuth tokens in a
file keyring encrypted with $GOG_KEYRING_PASSWORD. The claude-ops-daemon
systemd unit only exported HOME/PATH/CLAUDE_PLUGIN_ROOT, so in the headless
unit gog could not decrypt the tokens and returned nothing — extraction
silently logged "gog returned no data" and skipped the email source
entirely (observed on a Linux EC2 install: every run produced "No data
sources available — nothing to extract").

Add `EnvironmentFile=-%h/.config/systemd/env/mcp-secrets.env` (the same
secrets file the pocket/whatsapp helper units already consume) so the daemon
and its spawned services inherit GOG_KEYRING_PASSWORD + GOG_KEYRING_BACKEND.
gog then decrypts the keyring and resolves the default account from
~/.config/gogcli/config.json, so no GOG_ACCOUNT is needed. The (-) prefix
keeps the unit booting on installs that lack the file.

Verified: with the env present, the extractor's exact gog call returns email
JSON and the run advances from "gog returned no data" to "Collecting recent
emails... Calling Claude Haiku for extraction".

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: auroracapital

claude-ops/scripts/systemd/claude-ops-daemon.service

@@ -12,6 +12,16 @@ Environment=PATH=%h/.local/bin:/usr/local/bin:/usr/bin:/bin
 # CLAUDE_PLUGIN_ROOT is read by ops-daemon.sh and the services it spawns.
 # Override at install time if your marketplace dir lives elsewhere.
 Environment=CLAUDE_PLUGIN_ROOT=%h/.claude/plugins/marketplaces/ops-marketplace/claude-ops
+# memory-extractor (and any other gog-backed service the daemon spawns) calls
+# `gog gmail search` to collect email. gog stores its OAuth tokens in a file
+# keyring encrypted with GOG_KEYRING_PASSWORD; without GOG_KEYRING_PASSWORD +
+# GOG_KEYRING_BACKEND=file in the unit env, gog cannot decrypt them and returns
+# no data, so extraction silently logs "gog returned no data" and skips email.
+# These creds live in the same mcp-secrets.env used by the pocket/whatsapp
+# helper units. Optional (-) so installs without the file still boot; gog
+# resolves the default account from ~/.config/gogcli/config.json, so no
+# GOG_ACCOUNT is required here.
+EnvironmentFile=-%h/.config/systemd/env/mcp-secrets.env
 ExecStart=/bin/bash %h/.claude/plugins/marketplaces/ops-marketplace/claude-ops/scripts/ops-daemon.sh
 Restart=on-failure
 RestartSec=10