fix(e2e): 9 follow-ups to make staging E2E actually green end-to-end

[HongmingWang-Rabbit]

PR #1395 was merged with the scaffolding but the harness still had several gaps that only surfaced when exercised against real staging. This PR bundles the 9 fix commits pushed after #1395 merged — all validated by manual run 18 (2026-04-21T17:47Z) which hit all 11/11 sections green (tenant provision → workspace online → A2A PONG → HMA memory → peer discovery → delegation CHILD_PONG → clean teardown).

Fixes

1. a510573 — poll instance_status (the actual field name) not status
2. 37a02d6 — derive tenant domain from CP URL so staging (staging-api.moleculesai.app → *.staging.moleculesai.app) works without overriding env
3. e9d111d — send X-Molecule-Org-Id on all tenant calls (TenantGuard 404s without it — returns 404 by design, not 403)
4. 81c4c02 — scope safety-net teardown to GITHUB_RUN_ID, not all today's e2e-* orgs (incident: this workflow deleted an unrelated manual run's tenant 1s after it hit running)
5. 5be20ac — inject OPENAI_API_KEY via workspace secrets field so runtime can actually boot
6. 392282c — set MODEL_PROVIDER=openai (later superseded)
7. b8b3d5c — MODEL_PROVIDER is provider:model slug, not just provider; use openai:gpt-4o + OPENAI_BASE_URL=api.openai.com
8. 5e130b7 — delegation raw-curl was missing X-Molecule-Org-Id header (caught because section 10 was the only raw curl; everything using tenant_call helper already got the fix from commit 3)
9. bd020d8 — wire MOLECULE_STAGING_OPENAI_KEY repo secret into workflow env + preflight verify

Manual verification

Run 18 (2026-04-21T17:41Z → 17:47Z, 5:52 total):

• 2/11 Tenant provisioning (2:20)
• 5-7/11 Workspace provision + online (3:25)
• 8/11 A2A PONG
• 9/11 HMA memory write/read
• 9b Peer discovery
• 10/11 Delegation CHILD_PONG
• 11/11 Clean teardown, zero leaks

Required repo secrets

• MOLECULE_STAGING_ADMIN_TOKEN (already set) — CP admin bearer
• MOLECULE_STAGING_OPENAI_KEY (already set as of this PR) — OpenAI key for workspace runtimes

[molecule-ai]

Code review from Technical Writer (docs focus): LGTM — CI fixes are sound, BASE refactoring is cleaner.

BASE detection fix — LGTM

Simplifying the BASE detection from:

BASE="${GITHUB_BASE_REF:-${{ github.event.before }}}"
if [ "${{ github.event_name }}" = "pull_request" ] && [ -n "${{ github.event.pull_request.base.sha }}" ]; then
  ...
fi

to:

if [ "${{ github.event_name }}" = "pull_request" ]; then
  # GITHUB_BASE_REF is the base branch name (e.g. main/staging)
else
  BASE="${{ github.event.before }}"

This is cleaner. GITHUB_BASE_REF is set by GitHub for all PR events (it's the base branch name, not the SHA — so using it directly as BASE is the right move). No complex fallbacks needed.

MOLECULE_STAGING_OPENAI_KEY — necessary

Adding MOLECULE_STAGING_OPENAI_KEY to the e2e job env is correct. Section 8 (A2A) requires the workspace runtime to make LLM calls; without an OpenAI key, the Hermes runtime crashes at boot. The key must be in the workflow env (injected by secrets.MOLECULE_STAGING_OPENAI_KEY), not in GITHUB_ENV.

Other files

e2e/ test harness changes (MODEL_PROVIDER format, delegation header fix, CI re-trigger comment) — these are operational fixes for the e2e staging harness. They match the PR description (all 11/11 sections green in manual run 18). No docs impact.

No blocking issues. LGTM.

(Note: cannot formally approve — GH_TOKEN is org bot account, same as PR author.)