Bug: google-vertex sentinel value "" passed as literal API key to pi-ai

Summary

When getEnvApiKey("google-vertex") returns the sentinel string "<authenticated>"
(indicating ADC credentials are available), OpenClaw passes this literal string as
options.apiKey to pi-ai's google-vertex.js provider. The provider then calls
createClientWithApiKey(model, "<authenticated>", ...) instead of createClient()
(the ADC path), causing auth failures.

Root cause (pi-ai source, google-vertex.js line ~38-42):

const apiKey = resolveApiKey(options); // returns options?.apiKey || process.env.GOOGLE_CLOUD_API_KEY
const client = apiKey
    ? createClientWithApiKey(model, apiKey, options?.headers)
    : createClient(model, resolveProject(options), resolveLocation(options), options?.headers);

When options.apiKey = "<authenticated>", apiKey is truthy → goes to createClientWithApiKey
with the literal string "" as key → fails silently → OpenClaw falls back to next model.

Expected behavior

The sentinel value "<authenticated>" should be detected by OpenClaw before being passed
to pi-ai, and the call should be made without options.apiKey so pi-ai uses the ADC path.

Workaround

Removed all google-vertex model references from cron jobs, using anthropic/claude-sonnet-4-6 directly.

Environment

• OpenClaw 2026.3.13
• pi-ai (@mariozechner/pi-ai)
• macOS, isolated cron sessions
• GOOGLE_APPLICATION_CREDENTIALS set correctly, SA token confirmed working via gcloud