fix: pass provider keys to pi backend only

[Svaag]

Summary

The production canary on the dedicated loop VM proved that the service-level Vault-rendered env is present and Pi works when /opt/engineering-loop/.env is sourced, but the Engineering Loop backend subprocess scrubbed all provider API keys before invoking pi.

This keeps the allowlist model, but lets PiBackend receive only model-provider API keys:

• OPENROUTER_API_KEY
• ANTHROPIC_API_KEY
• OPENAI_API_KEY

Vault, GitHub App tokens, SSH agent state, cloud credentials, Discord/Icinga values, and app runtime credentials remain blocked from the backend subprocess.

Validation

• uv run pytest
• uvx ruff check src tests
• uv run mypy --strict src

Production evidence

• Step 2 live apply/rendering succeeded on loop.
• Manual canary issue docs: add Engineering Loop production canary note network-operations#235 reached the Pi backend but failed with No API key found for the selected model because the subprocess env removed provider keys.
• This PR fixes that specific backend env contract before retrying the canary.

[Svaag]

Production canary blocker fixed here. Local validation and CI are green: uv run pytest, uvx ruff check src tests, uv run mypy --strict src. No PR comments/code suggestions were present when checked.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: aa29db8ae5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep Pi env in sync with accepted provider keys

For live Pi runs where operators set only HYRULE_LLM_API_KEY (the generic key name accepted by provider_env_names()/provider_env() for OpenRouter, OpenAI, and Anthropic), this allowlist drops the sole configured provider credential. The live preflight can still mark provider_key as configured, but SubprocessBackend invokes pi with an env built from this set, so the backend still fails with no API key; either pass/translate the generic key for Pi or make preflight reject that configuration.

Useful? React with 👍 / 👎.