fix: use main_runtime api_key for custom provider in auxiliary tasks

[jamesarch]

When auxiliary.title_generation (or other auxiliary tasks) resolve to the 'custom' provider via an explicit base_url, the api_key fallback chain did not include the main runtime's api_key. This caused title generation to fail with 401 'login fail: Please carry the API secret key' when the main model was configured with minimax-cn credentials.

Root cause

In resolve_provider_client(), the 'custom' provider branch builds custom_key with this fallback order:

1. explicit_api_key
2. OPENAI_API_KEY env var
3. 'no-key-required'

It was missing: main_runtime.get('api_key'). When an auxiliary task (e.g. title_generation) uses a base_url that resolves to 'custom' provider, and that base_url matches the main runtime's endpoint, the main runtime's api_key should be used as a fallback.

Fix

Added main_runtime.get('api_key') to the custom_key fallback chain, so auxiliary tasks that reuse the main model's endpoint credentials work correctly.

Fixes: (title generation 401 with minimax-cn provider)

[jamesarch]

CI failures are unrelated to this PR.

Confirmed:

• main (fix(update): kill stale dashboards instead of warning #17832) also fails the same 6 tests in (pre-existing flakiness in process signal handling)
• This PR adds one websocket timeout () — also flaky
• This PR only touches api_key fallback logic, none of the failing test files are related

Recommendation:

1. These flaky tests should be fixed in a separate PR by maintainers
2. Consider re-running the test job for this PR

[teknium1]

Thanks for the focused auxiliary-auth fix. This automated hermes-sweeper review found that current main already provides the requested behavior through a later, broader implementation.

• agent/auxiliary_client.py:4623-4630 inherits the main credential for an explicit custom auxiliary endpoint.
• agent/auxiliary_client.py:2196-2213 restricts that inheritance to the same endpoint host, preventing a cross-host credential leak.
• agent/auxiliary_client.py:4637-4648 also directly reuses main_runtime endpoint credentials for named custom providers.
• tests/agent/test_auxiliary_named_custom_providers.py:503-522 covers reuse of the main-runtime endpoint and API key.
• The implementation shipped in v2026.7.7 via 92da7a997 and follow-up refactor 571f2a7fd.

Closing as implemented on main.