A keyless `provider: ollama|vllm|llamacpp` aux lane ran through the anonymous
`custom` key chain, so with OPENAI_API_KEY in the environment (or a main key on
the same host) the lane sent that secret as `Authorization: Bearer` to whatever
host `base_url` named. The alias means "this is my own server": only an explicit
`api_key` or the `no-key-required` placeholder is ever sent. `provider: custom`
keeps its documented OPENAI_BASE_URL + OPENAI_API_KEY contract.
Review follow-up on #113961; extends the existing parametrized invariant with the
OPENAI_API_KEY-set case (red on the previous head).
5b80838ea2