fix models-live matrix: resolve alias in PULLFROG_MODEL + pass all provider keys through docker

two bugs blocked the live matrix from reaching real APIs:

1. resolveModel returned PULLFROG_MODEL raw without passing it through the
   alias registry. when CI set PULLFROG_MODEL=anthropic/claude-opus (alias),
   the bare alias slug was forwarded to the Anthropic API as a model id and
   404'd. now resolves via resolveCliModel first, with raw specifiers
   (anthropic/claude-opus-4-6) still passing through unchanged.

2. the testEnvAllowList in docker.ts only forwarded Anthropic/OpenAI/Google
   keys into the test container. XAI/DeepSeek/OpenRouter/Moonshot/OpenCode
   keys got stripped, so every non-big-3 alias failed with "no API key found"
   even when the secret existed. add all five to the allowlist.

Made-with: Cursor

utils/docker.ts

@@ -118,6 +118,11 @@ const testEnvAllowList = new Set([
   "CLAUDE_CODE_OAUTH_TOKEN",
   "GEMINI_API_KEY",
   "GOOGLE_GENERATIVE_AI_API_KEY",
+  "XAI_API_KEY",
+  "DEEPSEEK_API_KEY",
+  "OPENROUTER_API_KEY",
+  "MOONSHOT_API_KEY",
+  "OPENCODE_API_KEY",
   "PULLFROG_MODEL",
   "LOG_LEVEL",
   "DEBUG",