Share configured LLM secret extraction across diagnostics paths

internal/framework/runner/runner.go

@@ -527,7 +527,7 @@ func validateSectionCandidates(ctx context.Context, input validateSectionCandida
 			diagnosticsWriter = &llmDiagnosticsWriterAdapter{
 				writer: llm.NewDiagnosticsWriter(
 					filepath.Join(input.DiagnosticsDir, input.Spec.InstanceName),
-					validatorSecrets(input.Config),
+					llm.ConfiguredSecrets(input.Config),
 				),
 			}
 		}
@@ -744,15 +744,3 @@ func (a *llmDiagnosticsWriterAdapter) WriteInteraction(stage string, requestMeta
 		ErrorPayloadPath:    art.ErrorPayloadPath,
 	}, nil
 }
-
-func validatorSecrets(cfg *config.Config) []string {
-	if cfg == nil {
-		return nil
-	}
-	effective := cfg.EffectiveValidationLLMConfig()
-	return []string{
-		cfg.PrimaryLLM.APIKey,
-		effective.APIKey,
-		cfg.ValidationLLM.APIKey,
-	}
-}