two bugs blocked the live matrix from reaching real APIs:
1. resolveModel returned PULLFROG_MODEL raw without passing it through the
alias registry. when CI set PULLFROG_MODEL=anthropic/claude-opus (alias),
the bare alias slug was forwarded to the Anthropic API as a model id and
404'd. now resolves via resolveCliModel first, with raw specifiers
(anthropic/claude-opus-4-6) still passing through unchanged.
2. the testEnvAllowList in docker.ts only forwarded Anthropic/OpenAI/Google
keys into the test container. XAI/DeepSeek/OpenRouter/Moonshot/OpenCode
keys got stripped, so every non-big-3 alias failed with "no API key found"
even when the secret existed. add all five to the allowlist.
Made-with: Cursor
Colin McDonnell
a71567af90