Read DOCKER_AGENT_ENV_-prefixed secret variables before the plain names #4702

Overview

Let docker-agent read DOCKER_AGENT_ENV_<NAME> in preference to <NAME> for every secret it resolves (e.g. DOCKER_AGENT_ENV_ANTHROPIC_API_KEY before ANTHROPIC_API_KEY).

Motivation

docker-agent resolves op:// 1Password references, which is a nice way to avoid plain-text keys. But the variable names are shared with other tools: exporting ANTHROPIC_API_KEY="op://…" in the shell breaks Claude Code, Codex and provider SDKs, which do not resolve op://. Today the workarounds are the docker-agent env file (~/.config/cagent/.env) or a per-model token_key, which must be repeated in every model of every config and does not apply to --model provider/model.

Use cases

export DOCKER_AGENT_ENV_ANTHROPIC_API_KEY="op://Personal/Anthropic/api-key"
export ANTHROPIC_API_KEY=sk-ant-...   # or unset; used by other tools
docker agent run agent.yaml          # uses the op:// reference

Also lets a user point docker-agent at a different key (separate billing/project) without touching other tools.

Proposed solution

A PrefixedProvider decorator in pkg/environment, wired through a single chain constructor as OnePassword(Prefixed(Multi(sources...))), so a prefixed value can itself be an op:// reference.

Decisions (revised after code review, see the comment below):

1. Prefix DOCKER_AGENT_ENV_. DOCKER_AGENT_ is docker-agent's settings namespace; names already in it are never looked up as overrides.
2. Precedence: DOCKER_AGENT_ENV_<NAME> wins across the whole chain, --env-from-file included.
3. Empty values: an empty override is ignored and <NAME> is used.

Doctor and follow-ups:

• docker agent doctor (findSource) queries sources directly and would report the key as missing; teach it the prefix and show which name supplied the value.
• The TUI transcriber reads OPENAI_API_KEY with os.Getenv (bypassing both op:// and the prefix); fixing it needs lazy resolution, so it is deferred to a separate PR.

Known limitation: in --sandbox, keys Docker Desktop proxies itself (OPENAI_API_KEY, ANTHROPIC_API_KEY, …) never go through our chain, so neither op:// nor the prefix applies to them there. Documented, not changed.

Alternatives

• Per-model token_key: works, but verbose and not available for --model shorthand.
• Docker Agent env file: works, but a plain shell export of the same name still wins, which is the common setup for users of several AI tools.

Related issues

• docs(secrets): credential helper only supplies DOCKER_TOKEN #4701: docs fix for the credential helper scope and an op:// isolation tip.
• Let credential_helper supply API keys and other secrets, not only DOCKER_TOKEN #4703: credential helper for all secrets.
• feat: read DOCKER_AGENT_ENV_-prefixed secret variables #4708: implementation.