fix(ci): scrub the registry credential before running repo code

Both Claude reviewers caught this independently, and they are right. The test
job I added wrote a PUSH-CAPABLE REGISTRY_PASSWORD into a plaintext
~/.gitconfig and then ran `go build`/`go vet`/`go test` — repository code — on
pull_request events. This repo is public, so a fork PR could ship a test whose
only job is to print that file. The image build had already answered this
question correctly: its credentials are BuildKit secrets scoped to the
module-download RUN and are never present while code executes. I bolted on a
job that skipped the boundary its neighbour maintains.

Dependencies are now fetched in their own step which deletes ~/.gitconfig
before anything else runs, and asserts the scrub — against the whole home
directory, not against the file it just removed, because the credential can
also land in ~/.netrc or ~/.config/go/env. Verified the assertion is not
vacuous: planting the secret in ~/.netrc trips it. Later steps run with
GOPROXY=off, so any attempt to reach the network fails loudly rather than
quietly hunting for the credential that is now gone.

Also from round 4: TestEndpointProviderNamesAreAllAccepted pinned only
endpointProvider, while the constant is the error text for BOTH resolution
paths — it now asserts each advertised name resolves either way (break-checked
by dropping the gemini alias from resolveModel alone). preflight.sh documents
that ollama-cloud is checked on OLLAMA_API_KEY but hinted as
OLLAMA_CLOUD_API_KEY because run.sh copies one to the other first, an ordering
dependency that was invisible from the file.

And the comments that narrated this PR's own edit history ("the first version
of this change...") are rewritten as invariants. That history stops being true
the moment this merges, and the repo's doc policy says as much.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

scripts/preflight.sh

@@ -2,10 +2,8 @@
 # Credential pre-flight for the agentic reviewer, in ONE definition.
 #
 # Sourced by run.sh (production) and by preflight_test.sh (the table test), so
-# there is no second copy to drift. An earlier version of this change had the
-# logic in run.sh and a duplicate in the test reconciled by a regex diff — that
-# guard only covered the provider table and not the decision logic below, which
-# is precisely the half that had the bug.
+# the tested bytes and the running bytes are the same. Keep it that way: a test
+# that reimplements this logic can agree with a stale copy of it.
 #
 # Why pre-flight at all, when majordomo already fails closed with a 401:
 # without it a missing key surfaces as five identical per-lens agent failures
@@ -15,15 +13,16 @@
 # gadfly_preflight_key <provider> -> echoes "" when the run may proceed, or the
 # name of the environment variable the operator must set.
 #
-# Scope: the REGISTRY path only — i.e. GADFLY_BASE_URL unset. That is deliberate.
-# With an explicit endpoint, resolveModel constructs the client directly and the
-# credential is GADFLY_API_KEY, falling back to the client's own default
-# (OPENAI_API_KEY for the openai family) — while the built-ins' own variables are
-# never consulted. Checking one path's rules against the other produced a
-# false-pass in BOTH directions across successive fixes here, so this checks the
-# path whose rules it can state exactly and stays silent on the other. An
-# override-path config is hand-written by definition; the registry path is the
-# one somebody hits by adding a model id to a var and forgetting the secret.
+# Scope: the REGISTRY path only — GADFLY_BASE_URL unset — and deliberately so.
+# The two resolution paths have DIFFERENT credential rules: with an explicit
+# endpoint the credential is GADFLY_API_KEY (falling back to the client's own
+# default, OPENAI_API_KEY for the openai family) and a built-in's own variable
+# is never consulted; without one, the reverse. Applying either path's rule to
+# the other yields a check that passes a run which then 401s — the precise
+# failure this exists to prevent. So it covers the path whose rules it can state
+# exactly and stays silent on the other. That is also the useful half: an
+# override-path config is hand-written, while the registry path is what somebody
+# hits by adding a model id to a var and forgetting the secret.
 gadfly_preflight_key() {
   local provider="$1" key_env="" key_hint=""
 
@@ -43,6 +42,12 @@ gadfly_preflight_key() {
   #      `google) key_env="GOOGLE_API_KEY"` would silently skip every reviewer
   #      configured with GEMINI_API_KEY. Pre-flighting google needs an
   #      either-variable check, not this table's one-name shape.
+  # ollama-cloud is checked on OLLAMA_API_KEY but hinted as OLLAMA_CLOUD_API_KEY:
+  # run.sh copies the consumer-facing OLLAMA_CLOUD_API_KEY secret into the
+  # OLLAMA_API_KEY the provider reads, BEFORE calling this. The hint names the
+  # variable the operator actually sets; the check reads the one the code uses.
+  # If that copy ever moves after this call, this arm reports a missing key for
+  # a configured run.
   case "$provider" in
     ollama-cloud)              key_env="OLLAMA_API_KEY";    key_hint="OLLAMA_CLOUD_API_KEY" ;;
     qwen)                      key_env="QWEN_API_KEY";      key_hint="QWEN_API_KEY" ;;

scripts/preflight_test.sh

@@ -1,10 +1,8 @@
 #!/usr/bin/env bash
 # Table test for the credential pre-flight in preflight.sh.
 #
-# It SOURCES the real implementation rather than copying it. An earlier version
-# duplicated the logic and reconciled the copies with a regex diff — which only
-# covered the provider table and not the decision logic, i.e. exactly the half
-# that had the bug. Sourcing removes the second copy entirely.
+# It SOURCES the real implementation rather than copying it, so there is no
+# second definition that can pass while production fails.
 #
 # Run: scripts/preflight_test.sh   (exit 0 = all cases pass)
 set -u