fix models-live matrix: resolve alias in PULLFROG_MODEL + pass all provider keys through docker

two bugs blocked the live matrix from reaching real APIs:

1. resolveModel returned PULLFROG_MODEL raw without passing it through the
   alias registry. when CI set PULLFROG_MODEL=anthropic/claude-opus (alias),
   the bare alias slug was forwarded to the Anthropic API as a model id and
   404'd. now resolves via resolveCliModel first, with raw specifiers
   (anthropic/claude-opus-4-6) still passing through unchanged.

2. the testEnvAllowList in docker.ts only forwarded Anthropic/OpenAI/Google
   keys into the test container. XAI/DeepSeek/OpenRouter/Moonshot/OpenCode
   keys got stripped, so every non-big-3 alias failed with "no API key found"
   even when the secret existed. add all five to the allowlist.

Made-with: Cursor

utils/agent.ts

@@ -16,14 +16,16 @@ function hasClaudeCodeAuth(): boolean {
  * resolve the effective model for this run.
  *
  * priority:
- *   1. PULLFROG_MODEL env var (explicit specifier override)
+ *   1. PULLFROG_MODEL env var — resolved through the alias registry first,
+ *      so values like "anthropic/claude-opus" become "anthropic/claude-opus-4-7".
+ *      raw specifiers (e.g. "anthropic/claude-opus-4-6") pass through unchanged.
  *   2. slug from repo config / payload → alias registry
  *   3. undefined — agent will auto-select
  */
 export function resolveModel(ctx: { slug?: string | undefined }): string | undefined {
   const envModel = process.env.PULLFROG_MODEL?.trim();
   if (envModel) {
-    return envModel;
+    return resolveCliModel(envModel) ?? envModel;
   }
 
   if (ctx.slug) {

utils/docker.ts

@@ -118,6 +118,11 @@ const testEnvAllowList = new Set([
   "CLAUDE_CODE_OAUTH_TOKEN",
   "GEMINI_API_KEY",
   "GOOGLE_GENERATIVE_AI_API_KEY",
+  "XAI_API_KEY",
+  "DEEPSEEK_API_KEY",
+  "OPENROUTER_API_KEY",
+  "MOONSHOT_API_KEY",
+  "OPENCODE_API_KEY",
   "PULLFROG_MODEL",
   "LOG_LEVEL",
   "DEBUG",