Runs and email-test find the Resend key in the Credentials #191

Parent

#190

What to build

A user who writes ~/.thirdshift/credentials.toml (the Credentials) by hand, with

[resend]
key = "re_..."

can get a Run notification from a Run or Spec run, and a test email from thirdshift email-test, without setting RESEND_API_KEY. The environment variable still wins when it's set and non-empty. This is how the key reaches Runs started from cron, nohup or an agent's shell (see #190 and ADR 0007).

Start with a prefactor that changes no behaviour: one key-lookup module answers "what's the Resend API key, and where did it come from" (the environment or the Credentials). The email sender and Setup's existing key hint both call it, instead of each reading RESEND_API_KEY themselves. Then add the file fallback.

Acceptance criteria

• Prefactor: every read of the Resend key goes through one lookup module, which reports the key's source. The existing tests pass unchanged after this step alone.
• With RESEND_API_KEY unset or empty and a key in the Credentials, email-test and a Run or Spec run that asked for a notification send with the file's key. Proved by the Authorization header ResendStandIn records.
• With both set, the environment variable's key is sent.
• With no key anywhere, email-test and a Run that asked for a notification exit 1 before any work with the missing-key message from Setup asks for the Resend API key and saves it in a Credentials file #190: run thirdshift setup; or add the key to the Credentials (real path, mode 600) in the shown [resend] / key = "re_..." format; or set RESEND_API_KEY in the environment the Run starts from (a crontab line, CI secret, or a shell profile the Run's shell reads). This replaces today's RESEND_API_KEY is unset or empty text.
• Invalid TOML, an unknown table or key (e.g. kye), or a non-string key in the Credentials stops email-test, or a Run that needs the key, before any work with exit 1, naming the file and the offending key. No notification is sent.
• A Credentials file readable by group or others is still used, with a warning: line on stderr saying to chmod 600 it.
• A missing Credentials file is not an error; it just means no key from the file.
• A Run without a notification succeeds with a broken Credentials file present, and update, version and help never read it.
• The README's Email and Run notifications sections describe the Credentials, the lookup order and the new missing-key message.
• Tests go through the binary with the tests/support harness, following tests/email_test.rs and tests/run_notification.rs. The lookup module gets no unit tests of its own.

Blocked by

None (can start immediately)