docs(progress): describe the shape this PR actually landed in

The progress entry was written before four review rounds reshaped the change:
it credited openaiCompatScheme alone, listed the tests as six per-provider
cases, and mentioned a captureRT detail that has since moved. Rewritten to
match what merges — registerOpenAICompatBuiltin owning both halves,
envKeyForProvider as the single LLM_<NAME> definition, and the shared table
that every OpenAI-compat built-in is now checked against.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

progress.md

@@ -302,15 +302,22 @@ tests flush out.
   `output_config.format` (which the shim does not implement), and cached-token
   accounting reads Anthropic-only usage fields. The shim is still reachable
   ad hoc via an `anthropic://` DSN.
-- kimi and qwen DSN factories were byte-identical, so they now share one
+- `registerOpenAICompatBuiltin` installs BOTH halves of an OpenAI-compat
-  `openaiCompatScheme` helper — the credential + key-hint rules come by
+  built-in (eager provider + `name://` DSN scheme via the shared
-  construction, not by copy.
+  `openaiCompatScheme`), so the two credential rules — unconditional
-- Hermetic tests: built-in base URL + bearer, missing key names QWEN_API_KEY
+  `WithAPIKey`, and `WithAPIKeyName` naming that same variable — hold by
-  with no OPENAI fallthrough and no network hit, the reverse leak (a visible
+  construction. kimi and qwen are one line each.
-  QWEN_API_KEY must not authenticate the openai built-in), `qwen://` round-trip
+- `envKeyForProvider` is the single definition of the `LLM_<NAME>` form,
-  against the China host, its keyless hint naming LLM_QCN, and
+  shared by lazy resolution (`registry.go`) and the DSN missing-key hint. They
-  `reasoning_effort` asserted on the wire body (the ADR's load-bearing claim).
+  were separate copies with a comment asserting they matched.
-  captureRT now records the request body; all six break-checked.
+- The shared contract is ONE table (`builtin_openaicompat_test.go`), run
+  identically for every OpenAI-compat built-in: endpoint + bearer, missing key
+  fails closed naming its own variable with no network hit, the `name://` DSN
+  reaching another host, and a keyless DSN naming `LLM_<NAME>` rather than the
+  built-in's key. Adding a built-in is a table row that immediately owes all
+  four; `builtin_kimi_test.go` was retired into it. Qwen-only tests: the
+  reverse credential leak, and `reasoning_effort` asserted on the wire body
+  (the ADR's load-bearing claim).
 - Docs in sync: README built-in table + Qwen paragraph + DSN scheme list +
   support matrix (footnote ⁴), `.env.example`, ADR-0027 (+ index).
 - Consumer: mort wants Qwen as a failover tier.