fix(qwen): the own-key fallback made the override path checkable

Round 9's best finding is that my own round-8 change falsified a rationale I
wrote in round 5. The pre-flight skips the endpoint-override path because "a
built-in's own variable is never consulted there" — then I gave kimi/qwen an
own-key fallback that consults exactly that variable on exactly that path. So a
keyless override config sailed past the check and failed as a 401, which is the
failure the check exists to replace.

Now that the rule is statable for those two providers, they are checked on both
paths ("own key or GADFLY_API_KEY"), while everything else stays silent on the
override path because its rules still are not.

The missing-key hint on the GADFLY_ENDPOINT_* path named the endpoint variable
— telling a keyless operator to put a credential in a Gitea var, which is not
masked, and contradicting the README warning added one round earlier. It now
always names the provider's own masked secret.

Also: the model argument is trimmed, since Go trims GADFLY_MODEL and padding
would otherwise slip past the claude-code exemption; the test job takes
`permissions: contents: read`, being the one job that executes PR-authored
code; and the ollama-cloud rationale is stated once.

Deliberately not taken, with reasons rather than silence: the credential-scrub
bash could be extracted to a testable script like preflight.sh was — fair, and
a follow-up, since moving it now would be a fresh untested surface at merge
time. `tr -d [:space:]` strips POSIX whitespace where Go strips Unicode, which
differs only for a GADFLY_BASE_URL made entirely of non-ASCII spaces. And the
two provider tests overlap but assert different contracts that should be able
to fail independently.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

scripts/preflight_test.sh

@@ -60,15 +60,22 @@ echo "== GADFLY_API_KEY does NOT substitute on the registry path =="
 # GADFLY_API_KEY changes nothing. Treating it as sufficient was a false pass.
 check "qwen w/ GADFLY_API_KEY only" "QWEN_API_KEY" "$(probe qwen GADFLY_API_KEY=k)"
 
-echo "== override path (GADFLY_BASE_URL set) is deliberately not pre-flighted =="
+echo "== override path: built-ins ARE checked; others are not =="
 # The credential there is GADFLY_API_KEY with a client-specific fallback, and
 # the built-ins' own variables are never read. Checking one path's rules
 # against the other produced a false pass in BOTH directions, so this path is
 # left alone rather than guessed at.
-check "qwen + BASE_URL, no keys"    "" "$(probe qwen GADFLY_BASE_URL=https://x)"
-check "qwen + BASE_URL + own key"   "" "$(probe qwen GADFLY_BASE_URL=https://x QWEN_API_KEY=k)"
+# A built-in reads its own key on the override path too (openAICompatOptions
+# falls back to QWEN_API_KEY/KIMI_API_KEY there), so "own key or GADFLY_API_KEY"
+# is statable and worth checking — leaving it unchecked let a keyless config
+# sail past and fail as a 401.
+check "qwen + BASE_URL, no keys"     "QWEN_API_KEY" "$(probe qwen GADFLY_BASE_URL=https://x)"
+check "qwen + BASE_URL + own key"    "" "$(probe qwen GADFLY_BASE_URL=https://x QWEN_API_KEY=k)"
 check "qwen + BASE_URL + GADFLY key" "" "$(probe qwen GADFLY_BASE_URL=https://x GADFLY_API_KEY=k)"
-check "openai + BASE_URL, no keys"  "" "$(probe openai GADFLY_BASE_URL=https://x)"
+check "kimi + BASE_URL, no keys"     "KIMI_API_KEY" "$(probe kimi GADFLY_BASE_URL=https://x)"
+# Other providers' override-path rules are not statable, so this stays quiet.
+check "openai + BASE_URL, no keys"   "" "$(probe openai GADFLY_BASE_URL=https://x)"
+check "anthropic + BASE_URL, none"   "" "$(probe anthropic GADFLY_BASE_URL=https://x)"
 
 echo "== providers needing no key are never blocked, with nothing set =="
 for p in ollama llama-swap llama-swaps llamaswap llamaswaps foreman google gemini some-dsn-name; do
@@ -89,6 +96,8 @@ echo "== engine specs carry their own auth and are never pre-flighted =="
 # ollama-cloud; judging it by that would skip a reviewer using
 # CLAUDE_CODE_OAUTH_TOKEN, which needs no Ollama key.
 check "bare claude-code, no ollama key" "" "$(GADFLY_TEST_MODEL=claude-code probe ollama-cloud)"
+# Go trims GADFLY_MODEL, so padding must not bypass the exemption.
+check "claude-code w/ whitespace"      "" "$(GADFLY_TEST_MODEL="  claude-code  " probe ollama-cloud)"
 check "claude-code/opus, no ollama key" "" "$(GADFLY_TEST_MODEL=claude-code/opus probe ollama-cloud)"
 # opencode is NOT exempt: it drives an ollama-cloud model and needs that key,
 # so skipping it would disable the pre-flight for the one engine it can help.