fix: preserve run provider capability

hub/test/unit/agent-security.test.ts

@@ -66,10 +66,7 @@ describe("agent subprocess security policy", () => {
         allowRead: expect.arrayContaining([canonicalWorkspace, "/usr/bin"]),
       },
       credentials: {
-        envVars: expect.arrayContaining([
-          { name: "ANTHROPIC_AUTH_TOKEN", mode: "deny" },
-          { name: "ANTHROPIC_API_KEY", mode: "deny" },
-        ]),
+        envVars: [],
       },
     });
   });

hub/test/unit/runner.test.ts

@@ -288,10 +288,7 @@ describe("runAgent", () => {
         },
         sandbox: {
           credentials: {
-            envVars: expect.arrayContaining([
-              { name: "ANTHROPIC_AUTH_TOKEN", mode: "deny" },
-              { name: "ANTHROPIC_API_KEY", mode: "deny" },
-            ]),
+            envVars: [],
           },
         },
       },