chore(secrets): drop OPENAI/GOOGLE/GROQ key shells (revoked, providers removed)

Those three providers were dropped in the Bedrock/Fireworks migration and their keys
revoked; the live Secrets Manager objects (open-swe-{dev,prod}/{OPENAI,GOOGLE,GROQ}_API_KEY)
were deleted (7-day recovery). Remove them from the IaC so a future cdk deploy does not
recreate the shells, and from fetch-config's mirror array so boot stops requesting them:
- config-store.ts SECRET_VARS + descriptions (28 -> 25 shells)
- fetch-config.sh SECRET_VARS array (kept in lockstep)
- put-config.sh: drop the put_secret lines; ANTHROPIC_API_KEY re-labelled optional
  (eval judge only — Bedrock builder/reviewer auth via the host IAM role).

REQUIRED_PROVIDER_KEYS is not set in SSM, so it uses the FIREWORKS_API_KEY default.

deploy/seahaven/fetch-config.sh

@@ -182,9 +182,9 @@ SECRET_VARS=(
   ANTHROPIC_API_KEY CORRIDOR_API_TOKEN CORRIDOR_MCP_TOKEN CORRIDOR_TOKEN
   DASHBOARD_JWT_SECRET DAYTONA_API_KEY EXA_API_KEY FIREWORKS_API_KEY
   GITHUB_APP_CLIENT_SECRET GITHUB_APP_PRIVATE_KEY GITHUB_PAT GITHUB_WEBHOOK_SECRET
-  GOOGLE_API_KEY GROQ_API_KEY JUDGE_ANTHROPIC_API_KEY LANGSMITH_API_KEY
+  JUDGE_ANTHROPIC_API_KEY LANGSMITH_API_KEY
   LANGSMITH_API_KEY_PROD LANGCHAIN_API_KEY LINEAR_API_KEY LINEAR_WEBHOOK_SECRET
-  OPENAI_API_KEY RUNLOOP_API_KEY SLACK_BOT_TOKEN SLACK_CLIENT_SECRET
+  RUNLOOP_API_KEY SLACK_BOT_TOKEN SLACK_CLIENT_SECRET
   SLACK_SIGNING_SECRET TOKEN_ENCRYPTION_KEY USER_ID_API_KEY_MAP X_SERVICE_AUTH_JWT_SECRET
 )
 

deploy/seahaven/put-config.sh

@@ -88,8 +88,7 @@ put_param() {
 # TOKEN_ENCRYPTION_KEY, GITHUB_APP_PRIVATE_KEY/CLIENT_SECRET, the active provider
 # key(s) (ANTHROPIC_API_KEY + OPENAI_API_KEY by default), LANGSMITH_API_KEY_PROD,
 # and (prod) GITHUB_WEBHOOK_SECRET + SLACK_SIGNING_SECRET.
-put_secret ANTHROPIC_API_KEY          # REQUIRED — primary builder provider key
-put_secret OPENAI_API_KEY             # REQUIRED — default reviewer provider key
+put_secret ANTHROPIC_API_KEY          # optional — eval judge only (JUDGE_ANTHROPIC_API_KEY fallback); Bedrock builder/reviewer use the host IAM role
 put_secret DASHBOARD_JWT_SECRET       # REQUIRED — dashboard session JWT signing
 put_secret TOKEN_ENCRYPTION_KEY       # REQUIRED — Fernet key(s) for GH-token crypto
 put_secret GITHUB_APP_PRIVATE_KEY     # REQUIRED — GitHub App PEM (multiline; quote it)
@@ -106,8 +105,6 @@ put_secret DAYTONA_API_KEY            # only if SANDBOX_TYPE=daytona
 put_secret EXA_API_KEY                # optional — Exa web search
 put_secret FIREWORKS_API_KEY          # active non-Claude key (fallback/subagents); Bedrock uses the host IAM role
 put_secret GITHUB_PAT                 # optional — PAT fallback
-put_secret GOOGLE_API_KEY             # only if a google_genai: model is used
-put_secret GROQ_API_KEY               # only if a groq: model is used
 put_secret JUDGE_ANTHROPIC_API_KEY    # optional — eval judge (falls back to ANTHROPIC)
 put_secret LANGSMITH_API_KEY          # optional — LangSmith (dev)
 put_secret LANGCHAIN_API_KEY          # optional — LangSmith alt name

infra/lib/constructs/config-store.ts

@@ -56,15 +56,12 @@ export const SECRET_VARS: readonly string[] = [
   "GITHUB_APP_PRIVATE_KEY",
   "GITHUB_PAT",
   "GITHUB_WEBHOOK_SECRET",
-  "GOOGLE_API_KEY",
-  "GROQ_API_KEY",
   "JUDGE_ANTHROPIC_API_KEY",
   "LANGSMITH_API_KEY",
   "LANGSMITH_API_KEY_PROD",
   "LANGCHAIN_API_KEY",
   "LINEAR_API_KEY",
   "LINEAR_WEBHOOK_SECRET",
-  "OPENAI_API_KEY",
   "RUNLOOP_API_KEY",
   "SLACK_BOT_TOKEN",
   "SLACK_CLIENT_SECRET",
@@ -73,7 +70,10 @@ export const SECRET_VARS: readonly string[] = [
   "USER_ID_API_KEY_MAP",
   "X_SERVICE_AUTH_JWT_SECRET",
 ] as const;
-// 28 secret shells. The T9 inventory header said "29" vs 27 enumerated; reconciled
+// 25 secret shells (OPENAI_API_KEY / GOOGLE_API_KEY / GROQ_API_KEY removed in the
+// Bedrock/Fireworks migration — those providers are dropped from SUPPORTED_MODELS and
+// their keys revoked + secret objects deleted). The T9 inventory header said "29" vs
+// 27 enumerated; reconciled
 // (Adam confirm 2026-06-26): USER_ID_API_KEY_MAP (maps user ids -> API keys; flagged
 // sensitive by the T5 security review) is a SECRET and is included here.
 // JUDGE_ANTHROPIC_BASE_URL is a URL (non-sensitive config, eval-only) -> SSM/default,
@@ -93,15 +93,12 @@ const SECRET_DESCRIPTIONS: Record<string, string> = {
   GITHUB_APP_PRIVATE_KEY: "GitHub App private key PEM (installation-token minting).",
   GITHUB_PAT: "GitHub PAT fallback (optional).",
   GITHUB_WEBHOOK_SECRET: "GitHub webhook signature secret (prod-required).",
-  GOOGLE_API_KEY: "Google GenAI key (only if a google_genai: model is used).",
-  GROQ_API_KEY: "Groq LLM key (only if a groq: model is used).",
   JUDGE_ANTHROPIC_API_KEY: "Eval judge key (optional; falls back to ANTHROPIC_API_KEY).",
   LANGSMITH_API_KEY: "LangSmith key (dev).",
   LANGSMITH_API_KEY_PROD: "LangSmith key (prod / deployed sandbox).",
   LANGCHAIN_API_KEY: "LangSmith key alt name (fallback).",
   LINEAR_API_KEY: "Linear API key (optional).",
   LINEAR_WEBHOOK_SECRET: "Linear webhook signature secret (required when Linear is wired).",
-  OPENAI_API_KEY: "OpenAI key (primary reviewer provider).",
   RUNLOOP_API_KEY: "Runloop sandbox key (only if SANDBOX_TYPE=runloop).",
   SLACK_BOT_TOKEN: "Slack bot token (optional).",
   SLACK_CLIENT_SECRET: "Slack OAuth client secret.",