R.4: remove config_snapshot and api_key_source; recordings keep identity only (A6 item 1, D3; stacked on #21)

[cunninghamcard-bit]

Phase 1R unit R.4 (A6 item 1, D3). Stacked on #21 (R.3), #20 and #19, so this diff includes them until they merge. The R.4-only changes are commits 2c57b5f and f5e72b0.

Removed (line numbers at 8455db9; re-located on this stack)

• aimux-core/src/decision_model.rs:556: trait default DecisionModel::config_snapshot. At :668, decide() now records ProviderRecord::from_model(model.provider(), model.model_id()), which is provider name + model name only.
• aimux-core/src/recording.rs:221,240: the ProviderRecord.api_key_source field and its initializer.
• Overrides: jev.rs (config_snapshot with the :102 api_key_source logic), openai/decision.rs, runtime_decision.rs, and decision_support.rs:61 (DecisionEndpoint::snapshot plus the now-unused headers()).
• provider_handle.rs: the api_key_source local and field, and HandleDecisionModel. ProviderHandle is now a plain forwarder over the resolved provider. The placeholder key itself stays for R.5.
• bindings/node/src/types/ProviderRecord.ts: apiKeySource? was removed by regenerating ts-rs (gen_ts_types.py). --check passes. The generator also strips trailing whitespace in the regenerated file.

git grep -n "config_snapshot\|api_key_source\|apiKeySource" -- ':!*.md' finds only scripts/check_provider_boundaries.sh (rules, R.5) and the three new apiKeySource-absent assertions below.

Test changes (assertions changed, no test deleted; cargo count unchanged)

• decision_recording_test.rs:91 (changed): ("apiKeySource","explicit") is now provider.get("apiKeySource").is_none(). The baseUrl check next to it also changed, from "ends with /v1/systemone" to "absent", because the record no longer carries it.
• decision_handle_test.rs:146 (changed): apiKeySource == "explicit" is now absent. The providerOptions.headers redaction checks in the same test became "baseUrl / providerOptions absent". The raw-secret-not-in-file checks are kept.
• decision_handle_test.rs:83 (config_snapshot_matches_model_identity, rewritten, now recorded_identity_matches_model_identity): it builds the record decide now writes (ProviderRecord::from_model). It asserts provider / providerId / modelId match the model, and that apiKeySource and baseUrl are absent.
• decision_handle_test.rs:184 (keyless placeholder test, removed assertion): the config_snapshot().api_key_source == "none" check is gone. The wire assertion (Bearer not-needed) stays until R.5.
• decision_handle_test.rs recorded_explicit_auth_headers_are_redacted (changed, not on the original list): it asserted providerOptions.headers = [REDACTED]. It now asserts the provider record has no providerOptions. The raw-secret-not-in-file checks are kept.
• runtime_decision_test.rs:608 (rewritten): the record used for rebuild_decision_provider is now ProviderRecord::from_model(...), the same identity decide records, and the api_key_source == "none" assert is dropped. Rebuilding through the registry still passes for all 6 local runtimes.
• runtime_decision_test.rs:616 (removed assertion): api_key_source == "explicit". The following :622 check, "explicit key is not in the recording, so rebuilding without a registration fails", now uses from_model.

Update (f5e72b0): base_url, profile and provider_options removed too

• Checks before deleting: no committed recording carries these fields. The only committed ProviderRecords are in aimux-providers/tests/fixtures/jev_systemone_live.jsonl, and they hold identity only. The fixtures/aisdk providerOptions and the cassettes are not ProviderRecords. ProviderRecord is not deny_unknown_fields.
• Removed the three fields, ProviderRecord::redacted and the feat: support official decision providers, candidate scoring, and native media arcships/aimux#226-only redact_provider_options helper. ProviderRecord.ts is now {providerId, provider, modelId}, and gen_ts_types.py --check passes.
• New recording::tests::provider_record_ignores_removed_snapshot_fields: JSON with baseUrl / apiKeySource / profile / providerOptions still deserializes into a ProviderRecord and re-serializes as identity only, so old recordings still load and replay.
• Grep (excluding rfc/, docs and *.md) leaves only the absence-asserting tests and that test's input JSON. The "profile" keys in provider_registry.json are registry rows, unrelated.
• Other bindings had no api_key_source references; the decision_capabilities hits there are the capabilities API and are untouched.

Results vs R.0 (local linux x64; new and renamed test names confirmed in the log)

	R.0 (8455db9)	R.3 (ff8fae7)	R.4 (f5e72b0)
cargo test --workspace	2871 / 0 / 7	2882 / 0 / 7	2883 / 0 / 7
fmt --check / clippy -D warnings	—	ok / ok	ok / ok
check_provider_boundaries.sh	0	0	0
gen_ts_types.py --check	—	up to date	up to date
Python pytest	93 pass, 5 fail	95 pass, same 5	95 pass, same 5 (same KeyErrors)
Node ava (node 22)	87 pass, 1 fail	93 pass, same 1	93 pass, same 1

Go/Java/Kotlin/Swift/Flutter were not run locally.

Review follow-up

• Merged updated R.3: remove implicit <PROVIDER>_API_KEY reading; native default key read at request time #21 (no change of its own).