Resolve typed credentials safely

docs/integrations/audita.md

@@ -41,7 +41,6 @@ Construction fails for invalid static config values, including:
 
 Run fails for:
 - missing required request paths;
-- missing required credential env var when configured (`llm_api_key_env`);
 - subprocess execution failure;
 - invalid processed transcript JSON (`segments` array required);
 - invalid report JSON when reporting is enabled.
@@ -53,6 +52,9 @@ Failure results still include output/log/config/exit metadata for diagnostics.
 
 ## Deterministic Behavior
 - CLI args are built from runner config + request in a fixed order.
+- A configured typed `llm_api_key` reference is resolved during pipeline load;
+  the captured value is supplied only as the child's `AUDITA_LLM_API_KEY`
+  override and is never re-read from the parent environment.
 - Generated invocation YAML (`audita.generated.v1`) is emitted when requested.
 - Manifest writes are stage-owned; adapter itself is stateless.