Accept secret-backed Codex credentials in deploy plans

[m-mohamed]

Summary

• count a secretEnv binding as a configured runtime environment value for presence-based secret conditions
• require OPENAI_API_KEY for the Codex harness only when no keychain credential is bound
• keep non-Codex OpenAI model-provider deployments on the API-key requirement

This makes the CLI deployment contract match core runtime validation: production Codex may authenticate from an operator-managed keychain credential without a duplicate API-billed key.

Verification

• red test reproduced the incorrect OPENAI_API_KEY requirement
• focused regression test passes
• npm run typecheck
• npm run lint
• node --test cli/test/secrets.test.ts (32/32)
• root and CLI production dependency audits: 0 vulnerabilities

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}