Let provider profiles fill a missing credential header #5312

User Story

An operator attaches a provider to a sandbox so an HTTP client can call an API without holding the real key.

Problem Statement

OpenShell can replace a credential placeholder in a header the client sends. If the API expects X-Api-Key and the client sends no such header, there is nothing to replace.

Impact / Why This Matters

Each client needs configuration to send the placeholder, or a wrapper if it cannot set headers. Ordinary Git and GitHub CLI authentication already work.

Proposed Design

Let a static credential opt in to supplying its header when absent. For example, a profile could set auth_style: header, header_name: X-Api-Key, and inject_if_absent: true. The client sends its usual HTTPS request; the service receives the key only if the attached provider’s enforced endpoint authorizes that request.

Acceptance Criteria

• Off by default. When enabled, supply the configured raw or bearer header only if it is missing. Preserve a caller-supplied field regardless of case, even if empty.
• A hostname match alone, another provider’s authorization, or an uninspected tunnel cannot trigger injection. Never supply an expired or detached credential.
• If two eligible credentials claim the same missing field, refuse the request before forwarding it.

Alternatives Considered

Use placeholders when the client supports them. Middleware can add ordinary headers, but it cannot write credential placeholders; giving it the real key would move the credential outside the provider.

Agent Investigation

The provider profile guide describes placeholder substitution. #4883 concerns where a supplied placeholder may resolve, rather than a header the client omitted.

Checklist

• I've reviewed existing issues and the published docs
• This is a design proposal, not a "please build this" request