[access-api-key-cutover] - Remove API-key resolvers and OAuth source marker

[JoshuaRowePhantom]

Part of #1512 and master #1505

Parent

• Direct parent: [access-secrets-github] - Track stored-secret environment and GitHub executor slices #1512.
• Architecture master: [access-broker] - Unify credential-use authorization, acquisition, renewal, and presentation #1505.

Dependencies

• Depends on: [access-agent-secrets] - Migrate AgentFactory and Copilot client credential uses #1542.
• Depends on: [access-github-consumers] - Migrate repository and persistence token callers #1543.
• Depends on: [access-github-usage] - Migrate GitHub usage providers to broker leases #1566.

Summary

Remove the remaining API-key resolver abstractions and the obsolete OAuth source marker after all callers are brokered.

Current Limitation / Root Cause

IApiKeyResolver, EnvironmentApiKeyResolver, and OAuthSecretSource would preserve alternate acquisition/source semantics after typed executors land.

Affected Files

Path	Change
Phantom.Workspaces.Llm.Core/IApiKeyResolver.cs	Remove or update only the named bounded production surface.
Phantom.Workspaces.Llm.Core/EnvironmentApiKeyResolver.cs	Remove or update only the named bounded production surface.
Phantom.Workspaces.Llm.Core/Secrets/SecretSource.cs	Remove or update only the named bounded production surface.
Focused test file	Add only the tests listed below.

Design / Fix

// Remove IApiKeyResolver and EnvironmentApiKeyResolver.
// Remove OAuthSecretSource from the closed SecretSource family.

Repository search must show no production construction, cast, or fallback to these types.

Security and Privacy Invariants

• No credential material, provider artifact, unsafe identifier, or raw provider output is introduced or copied during removal.
• Replacement callers already use typed broker requests and caller-owned leases.
• Removal fails the build if an undeclared production reference remains; it does not leave a fallback.

Exclusions

• No unrelated provider, UI, persistence-format, or behavioral redesign.
• No bridge, migration reader, or dual production path.

Commit Plan

Commit 1 — [access-api-key-cutover] - Remove API-key resolvers and OAuth source marker

Production types: IApiKeyResolver, EnvironmentApiKeyResolver, OAuthSecretSource.

Acceptance: one independently buildable commit affecting only the files above plus AccessMigrationTests.

Expected Tests

Test Name	Class	What It Verifies
AccessMigration_ProductionTree_HasNoIApiKeyResolver	AccessMigrationTests	Verifies the bounded cutover with no remaining production reference.
AccessMigration_ProductionTree_HasNoEnvironmentApiKeyResolver	AccessMigrationTests	Verifies the bounded cutover with no remaining production reference.
AccessMigration_ProductionTree_HasNoOAuthSecretSource	AccessMigrationTests	Verifies the bounded cutover with no remaining production reference.