design: agent credential handling for in-container agents #97

ADR 0009 leaves credential handling for in-container agents open. #96 records design input for it: an owner-run model gateway outside the workspace for API keys, the egress-policy precondition, and unverified candidates (Busbar, LiteLLM Proxy, agentgateway). Subscription CLIs (Claude Code, Codex, Antigravity) log in interactively and are not covered by a gateway.

Acceptance criteria

• A design (ADR or feature spec) decides how agent credentials reach a workspace for API-key use, including the provider-neutral seam (gateway URL and key reference) or an alternative.
• It defines the workspace egress policy a gateway would need, or states why none is needed.
• It answers the subscription-CLI case separately (guardrails per the auth roadmap).
• The ADR 0009 open-question section is resolved or superseded.

Design only; no implementation is authorized by this issue.

🤖 Generated with Claude Code