Secrets in `env.yaml` are exposed via `ps aux` / process command line

Describe the bug

gym env start passes the entire merged config including every secret in env.yaml (API keys, etc.) to each child server process as a literal VAR=value shell prefix embedded in the launch command string, rather than through the process's actual environment block. Therefore, secrets are in plaintext for any local user via ps aux / ps -ef / /proc/<pid>/cmdline for as long as the servers are running. This is CWE-214 (Invocation of Process Using Visible Sensitive Information)

Steps/Code to reproduce bug

1. Put any secret in env.yaml (e.g. openai_api_key: sk-...).
2. gym env start --resources-server --model-type .
3. On another shell (or as any other local user): ps aux | grep python — the full NEMO_GYM_CONFIG_DICT=... value, including the plaintext secret, is printed in the command line.

Expected behavior

Secrets from env.yaml should never appear in a child process's command line / argv (i.e. never visible via ps aux, ps -ef, or /proc//cmdline). They should only be readable via the process's actual environment block (/proc//environ), which is restricted to the process owner and root.

Configs
N/A

Environment details

• OS version: macOS 26.6.2 (Darwin)
• Python version: 3.13.14 (server venvs), 3.11.14 (system)

Start at the implementation of gym env start and trace how the merged env.yaml configuration is passed when child server processes are launched. Verify the difference between command-line arguments and the process environment, then reproduce with ps or /proc; done means secrets no longer appear in argv or command-line listings.