fix: make staging compatible with strict CSP

tests/staging-health.test.js

@@ -109,7 +109,7 @@ test('agent cookie is constrained to the normalized base path', async t => {
   const { origin } = await startServer(t, {
     TIMMY_BASE_PATH: '/timmy-staging/',
     TIMMY_AGENT_ENABLED: 'true',
-    TIMMY_AGENT_ACCESS_TOKEN: 'integration-access-code-2026',
+    TIMMY_AGENT_ACCESS_TOKEN: 'test-integration-access-code-2026',
     TIMMY_PUBLIC_ORIGIN: '__ORIGIN__',
     TIMMY_AGENT_WORKDIR: workdir,
     TIMMY_HERMES_COMMAND: hermesFixture,
@@ -119,7 +119,7 @@ test('agent cookie is constrained to the normalized base path', async t => {
   const response = await fetch(`${origin}/timmy-staging/api/agent/unlock`, {
     method: 'POST',
     headers: { 'content-type': 'application/json', origin, 'sec-fetch-site': 'same-origin' },
-    body: JSON.stringify({ accessCode: 'integration-access-code-2026' }),
+    body: JSON.stringify({ accessCode: 'test-integration-access-code-2026' }),
   });
   assert.equal(response.status, 200);
   assert.match(response.headers.get('set-cookie'), /; Path=\/timmy-staging\//);