fix(strix): route direct-OpenAI fallbacks through the OpenAI API base - #1324

Problem

Required-CI evidence (ContextualWisdomLab/bandscope#1021 strix run 32800796577, 2026-08-25): with provider_mode=nvidia_nim, the workflow sets LLM_API_BASE_FILE=https://integrate.api.nvidia.com/v1, and the gate reused that base for the contracted final fallback openai-direct/gpt-5.4. litellm sent OpenAI requests to the NVIDIA NIM edge, whose gateway answered a plain-text 404 page not found. The scan produced no vulnerability report artifact, so required CI failed closed on every org PR during NIM provider exhaustion.

Fix

• strix_quick_gate.sh — explicit direct-OpenAI fallback models resolve their API base through STRIX_OPENAI_FALLBACK_API_BASE_FILE when provisioned; without provisioning they resolve no override so litellm defaults to https://api.openai.com/v1. Primary-provider models keep existing resolution. Non-https overrides fail configuration (exit 2).
• strix.yml — provisions $RUNNER_TEMP/openai_fallback_api_base.txt alongside the OpenAI fallback key file and passes it into the gate environment.
• Smoke test pins both sides of the wiring.
• New regression contract: tests/test_strix_openai_fallback_api_base.py (7 cases).
• Doctoring evidence + CHANGELOG entry.

Verification

• Full central test suite: 1413 passed, 1 skipped, 16 subtests passed.
• bash scripts/ci/strix_required_workflow_smoke.sh: passed.
• bash -n scripts/ci/strix_quick_gate.sh: clean.

Expected effect

After merge, strix PR scans fall back to a reachable OpenAI endpoint when NIM exhausts, restoring authoritative complete scans (or genuine findings) instead of provider-unavailable failures across the org's PR queues.

Summary by CodeRabbit

• 버그 수정

  • 교차 제공자 폴백에서 직접 OpenAI 모델이 기본 제공자의 API 주소를 잘못 사용하는 문제를 수정했습니다.
  • 직접 OpenAI 폴백이 OpenAI 추론 엔드포인트로 안정적으로 연결됩니다.
  • 보안상 안전하지 않은 API 주소 설정은 허용되지 않도록 개선했습니다.

• 변경 사항

  • 직접 OpenAI 폴백 모델을 GPT-5.4로 업데이트했습니다.

• 문서

  • 폴백 라우팅 규칙, 설정 방식, 제한 사항을 문서화했습니다.

• 테스트

  • 다양한 제공자와 설정 조합에 대한 회귀 검증을 추가했습니다.