fix: resolve YAML env placeholders for API keys and remote shell env

[Manpreet2298]

Fixes #12842

Description

Fixes config YAML env placeholder resolution for API keys such as ${env:OPENROUTER_API_KEY}.

Previously, hardcoding an API key in YAML worked, but using ${env:VAR} could fail to resolve in some environments, leading to missing API keys and 401 errors.

This PR makes two focused fixes:

• resolves ${env:VAR} placeholders while converting YAML config into runtime config
• adds the same shell-environment fallback for LocalPlatformClient secret resolution, which helps in Remote-SSH / remote shell scenarios where process.env may not contain the expected variable

This is a minimal fix scoped to config/env resolution behavior.

AI Code Review

• Team members only: AI review runs automatically when PR is opened or marked ready for review
• Team members can also trigger a review by commenting @continue-review

Checklist

• I've read the contributing guide
• The relevant docs, if any, have been updated or created
• The relevant tests, if any, have been updated or created

Screen recording or screenshot

Not included, since this change affects config/env resolution rather than a visible UI flow.

If helpful for review, I can add a short repro note instead:

• hardcoded apiKey in YAML works
• ${env:OPENROUTER_API_KEY} now also works
• Remote-SSH/remote shell resolution is covered by the same fallback path

Tests

No automated tests were added in this change.

Manual validation suggested:

• confirm hardcoded apiKey in YAML works
• confirm ${env:OPENROUTER_API_KEY} works in local setup
• confirm ${env:OPENROUTER_API_KEY} works in Remote-SSH / remote shell setup where the variable is available from the user shell

---

Summary by cubic

Fixes YAML ${env:VAR} resolution across the config (including request options) and adds a shell-environment fallback that preserves multiline values to prevent missing API keys and 401s in local and Remote-SSH setups. Fixes #12842.

• Bug Fixes
  • Resolve env placeholders during YAML-to-runtime conversion across all fields, including requestOptions.
  • Fallback to the user's login shell when process.env is missing vars, preserving multiline values and working in Remote-SSH.

^{Written for commit 1bcea86. Summary will update on new commits.}

[cubic-dev-ai]

2 issues found across 3 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>