fix(tests): stop a real operator token from breaking the whole suite

The moment a real MASKANX_OPERATOR_TOKENS got set in Settings >
Environments (this session, for the first time on this machine), 28 tests
in test_campaign_launch.py started failing with 401 instead of the status
each was actually testing.

Cause: adclaw/__init__.py calls load_envs_into_environ() at import time,
so envs.json — the exact file the Settings UI writes — becomes ambient
environment for every test process, not only the ones that opt in.
Most campaign tests deliberately exercise the unauthenticated path and
never send an operator header; once a real token map exists,
require_operator starts demanding one they don't send.

This was already named as a deferred minor in the Phase 2 ledger
("test_campaign_api client fixture does not delenv MASKANX_OPERATOR_TOKENS")
but scoped to one file. It affects nine. An autouse fixture in
tests/conftest.py clears it before every test; a test that wants a token
still gets one, since its own monkeypatch.setenv runs after and overrides
it. Confirmed narrowly scoped: adding only this one delenv brought the
suite from 28 failed back to 1212 passed with nothing left over — no need
to guess at a wider blast radius.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/conftest.py

@@ -3,6 +3,26 @@
 
 import pytest
 
+
+@pytest.fixture(autouse=True)
+def _no_ambient_operator_tokens(monkeypatch):
+    """Never let a developer's real envs.json reach a test process.
+
+    `adclaw/__init__.py` calls `load_envs_into_environ()` at import time, so
+    whatever is saved in Settings > Environments on this machine becomes
+    ambient environment for every test in the suite — not just the ones
+    that opted in. Most campaign tests deliberately exercise the
+    *unauthenticated* path (MASKANX_OPERATOR_TOKENS unset), so once a real
+    operator token is configured for actual use, require_operator starts
+    demanding a header those tests never send, and they fail with 401
+    instead of the status the test is actually about. 28 tests broke this
+    way the first time a real token was set.
+
+    A test that wants a token still gets one: its own monkeypatch.setenv
+    runs after this fixture in the same test and overrides it.
+    """
+    monkeypatch.delenv("MASKANX_OPERATOR_TOKENS", raising=False)
+
 from adclaw.memory_agent.embeddings import FakeEmbeddingPipeline
 from adclaw.memory_agent.models import AOMConfig
 from adclaw.memory_agent.store import MemoryStore