fix: address Gadfly findings on kimi provider

- kimi:// DSN scheme: missing-credential hint now names the LLM_<NAME> env
  var that defines the provider (its token comes from the DSN, not
  KIMI_API_KEY), matching providerFor's lazy-resolution key form. Fixes the
  correctness/error-handling findings that the old hint misdirected users to
  set KIMI_API_KEY when the fix is adding a token to the DSN.
- parse_test.go: add kimi to TestBuiltinsResolve. (llama-swap stays excluded
  and is now documented — its no-URL built-in errors at Model() construction,
  not just on use, so it can't resolve there; the finding's llama-swap half
  was a false lead the test surfaced.)
- Add TestKimiSchemeMissingToken covering the corrected hint.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

builtin.go

@@ -2,6 +2,7 @@ package majordomo
 
 import (
 	"net/http"
+	"strings"
 
 	"gitea.stevedudenhoeffer.com/steve/majordomo/llm"
 	"gitea.stevedudenhoeffer.com/steve/majordomo/provider/anthropic"
@@ -95,13 +96,17 @@ func registerBuiltins(r *Registry, httpClient *http.Client) {
 		openai.WithAPIKeyName("KIMI_API_KEY"),
 	)...)
 	// kimi:// DSN scheme: an OpenAI-compatible target labeled kimi, base URL
-	// from the DSN host (e.g. kimi://[email protected]/v1 for China).
+	// from the DSN host (e.g. kimi://[email protected]/v1 for China). Its
+	// credential is the DSN token, not KIMI_API_KEY, so the missing-key hint
+	// names the LLM_<NAME> env var that defines this provider (matching the
+	// lazy-resolution key form in providerFor) — the fix for a keyless target
+	// here is adding a token to that DSN.
 	r.schemes[ProviderKimi] = func(name string, dsn DSN) (llm.Provider, error) {
 		return openai.New(openaiOpts(
 			openai.WithName(name),
 			openai.WithBaseURL(dsn.BaseURL()),
 			openai.WithAPIKey(dsn.Token),
-			openai.WithAPIKeyName("KIMI_API_KEY"),
+			openai.WithAPIKeyName("LLM_"+strings.ToUpper(strings.ReplaceAll(name, "-", "_"))),
 		)...), nil
 	}