refactor: single AGL_KEY in Secret for all auth env vars

K8s Secret stores only AGL_KEY. Job builder references it for all three:
  AGL_KEY → AGL_KEY (event posts, direct API)
  OPENAI_API_KEY → AGL_KEY (OpenAI SDK sends as Authorization: Bearer)
  ANTHROPIC_API_KEY → AGL_KEY (Anthropic SDK sends as x-api-key)

One secret, one value, three env vars. Gateway accepts both header formats.

agl_lite/controller/job_builder.py

@@ -47,26 +47,27 @@ def build_job_spec(
             "name": "AGL_POD_UID",
             "valueFrom": {"fieldRef": {"fieldPath": "metadata.uid"}},
         },
-        # OpenAI-compatible SDK env vars.
-        {"name": "OPENAI_BASE_URL", "value": f"{gateway_base}/v1"},
-        {
-            "name": "OPENAI_API_KEY",
-            "valueFrom": {"secretKeyRef": {"name": settings.secret_name, "key": "OPENAI_API_KEY", "optional": True}},
-        },
-        # Anthropic SDK env vars.
-        {"name": "ANTHROPIC_BASE_URL", "value": f"{gateway_base}/v1"},
-        {
-            "name": "ANTHROPIC_API_KEY",
-            "valueFrom": {"secretKeyRef": {"name": settings.secret_name, "key": "ANTHROPIC_API_KEY", "optional": True}},
-        },
-        # Task input and event URL.
-        {"name": "AGL_TASK_INPUT", "value": json.dumps(rollout.input)},
-        {"name": "AGL_EVENT_URL", "value": event_url},
-        # AGL_KEY for authenticating event posts and LLM proxy requests.
+        # Single AGL_KEY from Secret — used for all auth (gateway, event posts).
+        # Also injected as OPENAI_API_KEY and ANTHROPIC_API_KEY so SDKs send it
+        # as Authorization: Bearer / x-api-key headers automatically.
         {
             "name": "AGL_KEY",
             "valueFrom": {"secretKeyRef": {"name": settings.secret_name, "key": "AGL_KEY", "optional": True}},
         },
+        {
+            "name": "OPENAI_API_KEY",
+            "valueFrom": {"secretKeyRef": {"name": settings.secret_name, "key": "AGL_KEY", "optional": True}},
+        },
+        {
+            "name": "ANTHROPIC_API_KEY",
+            "valueFrom": {"secretKeyRef": {"name": settings.secret_name, "key": "AGL_KEY", "optional": True}},
+        },
+        # SDK base URLs — point to agl-lite gateway.
+        {"name": "OPENAI_BASE_URL", "value": f"{gateway_base}/v1"},
+        {"name": "ANTHROPIC_BASE_URL", "value": f"{gateway_base}/v1"},
+        # Task input and event URL.
+        {"name": "AGL_TASK_INPUT", "value": json.dumps(rollout.input)},
+        {"name": "AGL_EVENT_URL", "value": event_url},
     ]
 
     # User-specified env vars from rollout config (override defaults).

tests/controller/test_job_builder.py

@@ -74,14 +74,16 @@ class TestBuildJobSpec:
         # Pod UID via Downward API.
         assert env_map["AGL_POD_UID"]["valueFrom"]["fieldRef"]["fieldPath"] == "metadata.uid"
 
-        # OpenAI SDK.
+        # All three API key env vars reference the same AGL_KEY in Secret.
+        for env_name in ("AGL_KEY", "OPENAI_API_KEY", "ANTHROPIC_API_KEY"):
+            ref = env_map[env_name]["valueFrom"]["secretKeyRef"]
+            assert ref["name"] == "agl-secrets"
+            assert ref["key"] == "AGL_KEY"
+
+        # SDK base URLs.
         assert "$(AGL_POD_UID)" in env_map["OPENAI_BASE_URL"]["value"]
         assert env_map["OPENAI_BASE_URL"]["value"].endswith("/v1")
-        assert env_map["OPENAI_API_KEY"]["valueFrom"]["secretKeyRef"]["name"] == "agl-secrets"
-
-        # Anthropic SDK.
         assert "$(AGL_POD_UID)" in env_map["ANTHROPIC_BASE_URL"]["value"]
-        assert env_map["ANTHROPIC_API_KEY"]["valueFrom"]["secretKeyRef"]["name"] == "agl-secrets"
 
         # Task input.
         assert json.loads(env_map["AGL_TASK_INPUT"]["value"]) == {"task": "code"}
@@ -89,10 +91,6 @@ class TestBuildJobSpec:
         # Event URL.
         assert "/events" in env_map["AGL_EVENT_URL"]["value"]
 
-        # AGL_KEY from Secret.
-        assert env_map["AGL_KEY"]["valueFrom"]["secretKeyRef"]["name"] == "agl-secrets"
-        assert env_map["AGL_KEY"]["valueFrom"]["secretKeyRef"]["key"] == "AGL_KEY"
-
     def test_user_env_vars_appended(self, settings: ControllerSettings):
         rollout = _make_rollout(config_overrides={"environment_variables": {"MY_VAR": "hello"}})
         job = build_job_spec(rollout, None, settings)