fix(qwen): bump majordomo, and stop handing keys to the wrong vendor

Round 6, and one finding exposed something no reviewer mentioned: the majordomo
bump this whole PR depends on was never made. Every test here builds the openai
client directly, so all of them passed against a majordomo release that had
never heard of qwen — a plain "qwen/<model>" in GADFLY_MODELS, the primary way
anyone will use this, would not have resolved at all. A compile error caught it,
which is luck. TestBuiltinCompatProvidersResolveViaRegistry now exercises that
path; the build is what guards the dep itself, since the old release cannot
compile the code below.

On the endpoint-override path, kimi and qwen fell through to openai.New's
OPENAI_API_KEY default whenever GADFLY_API_KEY was unset — sending an OpenAI
key to Moonshot or Alibaba. That is a credential handed to the wrong vendor,
and it is the exact failure majordomo's built-ins are written to prevent; I
reintroduced it one layer up. Both now pass the key unconditionally, so an
absent key is a 401 naming GADFLY_API_KEY rather than a foreign credential on
the wire.

The test job scrubbed the registry credential and left the checkout token in
.git/config, readable by the `go test` it then runs — fixing one credential
while its neighbour sat in the open. persist-credentials: false; nothing in
that job talks to git after checkout.

The cross-language wiring test now QUERIES preflight.sh via a new
gadfly_preflight_providers function instead of regexing its case statement.
Parsing made that file's formatting a contract no linter enforces, where a
harmless reformat breaks a test in another language. Two models flagged it.

Also: grep for the scrub check takes -e, so a password starting with a hyphen
is not read as options; and key_hint stopped repeating key_env in four of five
arms.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

scripts/preflight.sh

@@ -55,12 +55,16 @@ gadfly_preflight_key() {
   # If that copy ever moves after this call, this arm reports a missing key for
   # a configured run.
   case "$provider" in
-    ollama-cloud)              key_env="OLLAMA_API_KEY";    key_hint="OLLAMA_CLOUD_API_KEY" ;;
-    qwen)                      key_env="QWEN_API_KEY";      key_hint="QWEN_API_KEY" ;;
-    kimi)                      key_env="KIMI_API_KEY";      key_hint="KIMI_API_KEY" ;;
-    openai|openai-compatible)  key_env="OPENAI_API_KEY";    key_hint="OPENAI_API_KEY" ;;
-    anthropic)                 key_env="ANTHROPIC_API_KEY"; key_hint="ANTHROPIC_API_KEY" ;;
+    ollama-cloud)              key_env="OLLAMA_API_KEY" ;;
+    qwen)                      key_env="QWEN_API_KEY" ;;
+    kimi)                      key_env="KIMI_API_KEY" ;;
+    openai|openai-compatible)  key_env="OPENAI_API_KEY" ;;
+    anthropic)                 key_env="ANTHROPIC_API_KEY" ;;
   esac
+  # The hint is the variable the operator sets, which equals the one the code
+  # reads everywhere except ollama-cloud (see the note above).
+  key_hint="$key_env"
+  [ "$provider" = "ollama-cloud" ] && key_hint="OLLAMA_CLOUD_API_KEY"
 
   if [ -z "$key_env" ]; then
     echo ""                       # provider needs no pre-flight
@@ -75,3 +79,18 @@ gadfly_preflight_key() {
   fi
   echo "$key_hint"
 }
+
+# gadfly_preflight_providers echoes every provider this file has a credential
+# arm for, one per line.
+#
+# It exists so callers can ASK which providers are covered instead of parsing
+# the case statement. A Go test cross-checks this list against the provider
+# table in cmd/gadfly/model.go; having it regex this file would make the shell
+# formatting a contract no linter enforces, where a reformat breaks a test in
+# another language for no visible reason.
+#
+# Keep in step with the case arms above — the Go test fails if a provider in
+# either list is missing from the other.
+gadfly_preflight_providers() {
+  printf '%s\n' ollama-cloud qwen kimi openai openai-compatible anthropic
+}