6a8e9b3d79
- submitAgentRunChatTurn resolves owner user API key via accessController.store.findActiveDefaultApiKeyForUser - buildAgentRunRunnerJobInput accepts ownerApiKey; when present, removes HWLAB_DEVICE_POD_API_KEY and adds HWLAB_API_KEY as sensitive - buildAgentRunTransientEnv no longer emits HWLAB_DEVICE_POD_API_KEY - codex-stdio child env now reads HWLAB_API_KEY (not HWLAB_DEVICE_POD_API_KEY) - server-code-agent-http codeAgentAuthEnv looks up user default API key; URL env vars still set unconditionally - tests: code-agent-session-registry Codex child env carries only device-pod API key now checks HWLAB_API_KEY - tests: server-agent-chat delegates v0.2 turns removes HWLAB_DEVICE_POD_API_KEY assertion - 58 pass / 4 pre-existing fail