CB-635: --check reports whether broker.uriEnv resolves in a login shell

An empty uriEnv no longer stops the daemon (#152), so the failure is quiet: bridged
starts, falls back to the in-memory reply inbox, and held reports stop surviving a
restart. --check is the only thing that says so before the fact. The var name is read
out of bridged.yaml so a renamed key cannot make the check lie.

scripts/redeploy-bridged.sh

@@ -179,6 +179,22 @@ else
   warn "This only matters once a profile points at llm.ltms.dev — harmless before that."
 fi
 
+# Third variable, same trap (CB-635). broker.uriEnv names the env var holding the AMQP URI, so the
+# password stays out of bridged.yaml — but that moves the failure into the environment. If the
+# variable is empty the daemon still starts: since #152 it warns and falls back to the in-memory
+# reply inbox, so nothing crashes and replies simply stop surviving a restart. Only this check says
+# so before the fact. Read the name out of the config so a renamed key cannot make the check lie.
+BROKER_URI_ENV=$(sed -n 's/^[[:space:]]*uriEnv:[[:space:]]*\([A-Za-z_][A-Za-z0-9_]*\).*/\1/p' "$BRIDGED/bridged.yaml" | head -1)
+if [ -z "$BROKER_URI_ENV" ]; then
+  ok "no broker.uriEnv configured — reply inbox is in-memory by design"
+elif zsh -lc "[ -n \"\${$BROKER_URI_ENV:-}\" ]" 2>/dev/null; then
+  ok "$BROKER_URI_ENV (broker.uriEnv) resolves in a login shell"
+else
+  warn "$BROKER_URI_ENV (broker.uriEnv) is EMPTY in a login shell."
+  warn "The daemon will start and fall back to the IN-MEMORY reply inbox."
+  warn "Replies stop surviving a restart — a held report is lost, not delayed."
+fi
+
 if [ "$CHECK_ONLY" = 1 ]; then
   say "--check: nothing changed"
   exit 0