Migrate Notarius to credential lists

internal/adapters/notarius/subprocess.go

@@ -52,19 +52,9 @@ func (r *SubprocessRunner) Run(ctx context.Context, req RunRequest) (RunResult,
 	if err != nil {
 		return RunResult{}, err
 	}
-	var envOverrides map[string]string
-	var sensitiveEnvNames []string
-	if req.LLMAPIKey != nil {
-		if !req.LLMAPIKey.IsResolved() {
-			return RunResult{}, fmt.Errorf("notarius LLM API credential must be resolved and nonempty")
-		}
-		name := req.LLMAPIKey.EnvName()
-		value := req.LLMAPIKey.Value()
-		if value == "" {
-			return RunResult{}, fmt.Errorf("notarius LLM API credential must be resolved and nonempty")
-		}
-		envOverrides = map[string]string{name: value}
-		sensitiveEnvNames = []string{name}
+	envOverrides, sensitiveEnvNames, err := subprocess.CredentialEnvironment(req.Credentials)
+	if err != nil {
+		return RunResult{}, fmt.Errorf("notarius credentials: %w", err)
 	}
 
 	args := []string{