Configure environment-backed AI Gateway for external runtimes

[chubes4]

Problem

The external OpenCode profile merged in #359 correctly avoids installing/configuring WordPress plugins and avoids writing gateway credentials into the runtime. It also skips ai_gateway_configure_opencode, leaving persistent external OpenCode/Kimaki without the wp-ai-gateway/site-default provider definition even when OPENAI_BASE_URL and OPENAI_API_KEY are delivered securely in the runtime process environment.

A one-shot mediator can pass --model wp-ai-gateway/site-default, but the persistent profile cannot resolve that provider from its generated opencode.json. Product templates should not duplicate the wp-coding-agents-owned provider shape.

Desired behavior

When --external-wordpress --runtime opencode --with-ai-gateway is selected:

• keep skipping plugin installation, gateway route mutation, token minting, and .opencode/wp-ai-gateway.env writes
• add the existing credential-free wp-ai-gateway provider/model shape to runtime-local opencode.json
• reference ${OPENAI_BASE_URL} and OPENAI_API_KEY only through OpenCode environment placeholders
• require the operator/runtime to supply those variables when OpenCode or Kimaki starts
• preserve current colocated --with-ai-gateway behavior unchanged
• verify no secret value or external endpoint is persisted in generated files

Acceptance

• external runtime regression asserts the provider and default model are generated
• setup reruns are idempotent
• no WordPress mutation command or gateway env file is produced for external mode
• missing runtime credentials fail at runtime, not by baking credentials into setup output

AI assistance

OpenAI gpt-5.6-sol via OpenCode was used to trace the merged external-profile and AI Gateway setup contracts and draft this issue. Chris Huber reviewed and is responsible for the tracker content.

[chubes4]

Live external-runtime verification found the merged placeholder is not interpreted by OpenCode. provider.wp-ai-gateway.options.baseURL is emitted as ${OPENAI_BASE_URL}, which reaches the provider literally and fails before HTTP with "${OPENAI_BASE_URL}/chat/completions" cannot be parsed as a URL. OpenCode config environment interpolation uses {env:OPENAI_BASE_URL}. I am preparing a focused regression fix and runtime proof. AI assistance: OpenAI gpt-5.6-sol via OpenCode was used to trace the live failure and identify the config contract; Chris Huber remains responsible for the report and resulting change.