[Feat] Separate model credentials from task environment

[roomote-roomote]

Opened on behalf of Matt Rubens. Follow up by mentioning @roomote-roomote, in the web UI, or in Slack.

What changed

• Store model-provider settings in a dedicated encrypted table while dual-writing and falling back to legacy environment-variable rows for N-1 rollback compatibility.
• Keep model-provider credentials out of generic task setup, services, snapshots, live reloads, and child shells; deliver them only to the inference gateway or agent harness, reconnecting the harness when live credentials change.
• Version the worker environment contract so current workers receive separate task and model maps while older workers continue receiving the legacy flat response.
• Hide and temporarily reserve built-in, OpenAI-compatible, and custom declared model-provider names in generic Environment Variables settings.

Why this change was made

Model-provider credentials and task environment variables previously shared storage and runtime delivery paths. That allowed generic task configuration to affect Roomote model inference and exposed model credentials more broadly inside task runtimes than necessary.

Impact

Model credentials are now configured and resolved independently from task variables. Existing deployments remain rollback-safe during the compatibility release, while current workers constrain credentials to the model runtime, remove revoked values during live reload, and restart the model process with the refreshed environment.

[roomote-community]

1 issue outstanding. See task

• apps/worker/src/sandbox-server/procedures/reloadDeploymentEnvVars.ts:92 The live-reload path only replaces OpenCodeServerHarness.commandEnv; it does not update the already-running OpenCode process. Model credentials are no longer written to BASH_ENV, so newly saved credentials cannot take effect and revoked credentials remain in that process until a reconnect/restart. Rebuild or reconnect the harness with the fresh model runtime environment, including its credential-scrubbing overlay.
• apps/worker/src/sandbox-server/procedures/reloadDeploymentEnvVars.ts:104 The reconnect command environment omits ROOMOTE_HARNESS_ONLY_SECRET_NAMES. prepareOpenCodeCommandEnv consumes and removes that marker when the original process starts, so the restarted process rebuilds its BASH_ENV overlay without unsetting newly added provider credentials. Any shell tool started by OpenCode after a live model-credential update then inherits the credential. Carry the fresh provider-key list into the reconnect environment and cover it with an integration test.

_{Reviewed e0f9cd4}

[roomote-roomote]

Fixed the live-reload process lifecycle issue in e0f9cd4. Model-runtime changes now update the reconnect spawn environment and immediately restart the harness, so added and revoked credentials take effect in the running model process.