fix: include provider credentials in preflight probes

[rudijetson]

Summary

• build the selected provider environment before Agent Host auth/version probes
• forward only credentials declared by that provider
• keep unrelated environment secrets out of probe processes

Verification

• focused preflight tests: 2 passed
• full CLI suite: 634 passed
• pnpm build
• architecture-aware debt scan: 0 findings
• npm pack --dry-run
• git diff --check

Reconciliation context

This preserves an admin-Mac-only fix by replaying it onto the current GitHub main in a clean worktree.