Preserve vision credential bindings and channel hint contract

[FerroxLabs]

Desktop mirrors the selected custom-provider key into OPENAI_API_KEY; vision previously chose OpenAI’s native endpoint before consulting that provider. Keep matching credentials paired with their configured destination, including whitespace variants, and fail closed for malformed or unsupported matching bindings. Preserve independent native OpenAI credentials, explicit Anthropic precedence, model overrides and accounting.

Also align the untrusted-channel directive and independent wire oracle with the existing “Experimental skill hint:” producer label. The wire fixture now creates and explicitly selects a project-local skill and asserts its actual hint reaches the provider, so the regression is exercised on a clean host. Strict sender-byte, forged-marker, unknown-block and system-role controls remain.

Necessary ledger reconciliation preserves #455’s existing grading across its byte-identical squash (28634521 and 1780b316, tree 90e028ae6de0537c60c1d86450ceb3083ae4610b). Five lost ancestry anchors are repinned, and existing #1116/#443 unresolved dispositions remain not met. No acceptance gate, signing policy, tag or release is changed.

Validation on exact c98b58c6ef0c028c4830bd62a10712c560b930b1:

• Normal just push: workspace Clippy with warnings denied, formatting, complete preflight, and full nextest 18,071 passed, 104 skipped. Dedicated WAYLAND_HOME prevents host-installed skills/credentials contaminating the fixtures.
• Original resolver fails the fake-key loopback regression; corrected routing controls pass. Channel directive 5/5 and actual wire integration 8/8 pass.
• Windows Rust1.95.0 release/voice build succeeds; measured binary SHA256 cf196abc1ddd4ee30ffa7385d003260eb98c63bae0a5b49a85e45429ad20b737. Development build only; native report and final signed-release qualification remain separate.

Related coordination: FerroxLabs/wayland#1324. Desktop consumer PR: FerroxLabs/wayland#1348.