What Problem This Solves

Reply turns with exec-backed models.providers.*.apiKey SecretRefs currently call secrets.resolve against the gateway even though that RPC cannot execute those providers. The client immediately falls back to local resolution, so the turn succeeds, but every reply floods the gateway log with a misleading UNAVAILABLE error.

Summary

• bypass reply-path secrets.resolve RPCs when active target SecretRefs already require local exec resolution
• resolve those reply credentials locally up front instead of emitting a guaranteed UNAVAILABLE gateway error each turn
• add a regression test covering models.providers.*.apiKey exec SecretRefs on the reply path

Evidence

• pnpm exec vitest run src/agents/provider-transport-fetch.test.ts src/cli/command-secret-gateway.test.ts --maxWorkers 1
• added regression coverage that asserts reply skips the gateway RPC, resolves models.providers.google.apiKey locally, and records resolved_local without calling callGateway

Closes #96653