Provision OPENAI_API_KEY for optional OpenAI provider/fallback runs

[micahstubbs]

Board issue: sia_rust-e2j.7

Finding

The local environment does not define OPENAI_API_KEY. This is not required for the default Anthropic path or the Nebius hackathon path, but it is required for the bundled openai provider and for the no-provider fallback in the OpenHands and PydanticAI runners.

Code path

• docs/CREDENTIALS.md:22 documents OPENAI_API_KEY for the bundled OpenAI provider and runner fallback.
• sia/defaults/providers/openai.json declares api_key_env = OPENAI_API_KEY.
• src/agent_impls/openhands.rs:47 describes the fallback to the OpenAI public endpoint.
• src/agent_impls/openhands.rs:53 reads OPENAI_API_KEY when no provider is supplied.
• src/agent_impls/pydantic_ai.rs:41 and src/agent_impls/pydantic_ai.rs:48 do the same for PydanticAI.

Acceptance criteria

• Decide whether OpenAI-backed profiles/fallback runners are in scope for this environment.
• If yes, add a valid key to secure local/team secret storage and the runtime environment as OPENAI_API_KEY.
• Do not commit the secret value or paste it into GitHub.
• Verify an OpenAI-provider or no-provider fallback smoke path, attaching only non-secret output.