[Code Review Tool] Centralize provider credentials behind one execution path

We hit an uncomfortable production failure mode. Policy checks were enforced in the main execution path, but one background worker still had direct provider credentials from an earlier prototype. That worker could call the model outside the controlled execution flow. We first tuned model behavior and retries. Wrong layer. The failure was architectural. A non-trivial slice of calls had no \`run\_id\` or \`step\_id\`, which meant they bypassed policy and audit entirely. The fix ended up being infrastructure-level: \- centralize provider credentials behind one execution path \- block direct egress to provider endpoints \- reject requests without run identity \- alert on ungated call patterns After this, shadow calls dropped to zero and audit coverage became reliable again. How are teams here preventing bypass paths in practice: egress controls, credential brokering, or admission policy?