fix(worker-auth): unify token checks and bind job environment

packages/backend/convex/userEnvironment.ts

@@ -71,6 +71,7 @@ export const getRawEnvironmentForJobInternal = internalQuery({
   handler: async (ctx, { jobId }) => {
     const job = await ctx.db.get(jobId);
     if (!job) return null;
+    if (!job.claimedBy) return null; // only a claimed job's env is exposed
     const ownerId = job.ownerId;
     const [user, settings, files] = await Promise.all([
       ctx.db.get(ownerId),