Add request API key support

docs/internal/runner.md

@@ -104,9 +104,10 @@ Validation content failures are not run errors:
    - selected profile values
    - request overrides
    - request numeric overrides are presence-aware, so omitted values preserve the current effective value and explicit zero values override it
-6. verify required `api_key_env` environment variable:
-   - missing/empty env value returns an invalid request with `ErrAPIKeyEnvMissing`
-   - only the environment-variable name is retained; secret value is never returned
+6. verify credentials when the effective target names `api_key_env`:
+   - a request-scoped direct API key satisfies the credential requirement
+   - otherwise a missing/empty env value returns an invalid request with `ErrAPIKeyEnvMissing`
+   - only the environment-variable name is returned in public output; secret values are never returned
 7. resolve output contract and structured-output schema payload when `json_schema` mode is active.
 8. read input artifacts.
 9. render prompt messages, including any normalized message cache-control metadata.
@@ -122,7 +123,8 @@ Runtime target notes:
 - The OpenAI-compatible client serializes non-empty `reasoning_effort` as a top-level provider request field.
 - The OpenAI-compatible client flattens `extra_params` into provider-specific top-level JSON request fields.
 - Empty `extra_params` keys, reserved outbound field names, and values that cannot be JSON-encoded fail before the provider request.
-- Resolved API-key values are never stored in `PreparedRun`, `RunResult`, logs, or HTTP responses.
+- Resolved API-key values are never serialized in prepared/run output, public results, logs, or HTTP responses.
+- Public direct API-key values are carried only far enough to call the configured LLM client and are excluded from JSON/YAML serialization.
 
 ## Run Flow