The six provider keys sat in job-level env, so every step saw them: uv sync (and any sdist build backend it runs), setup-uv, checkout and the retry action. The job now carries only secrets.X != '' booleans for the gate, and the values are set on 'Run live canaries' alone. actionlint clean.