Live smokes: prefer keyless demo endpoints so coverage never silently skips #48

Karl's observation (2026-07-03): the public /v1/demo/* endpoints can carry most live-smoke coverage (route health, envelope shape, prices flowing) with NO secret — the demo-contract tests already caught the 442→436 catalog change keyless. Refactor guidance for all SDK repos: tier the live jobs as (1) always-run keyless demo smoke (can never silently skip), (2) keyed tests for auth path + gated endpoints when OILPRICEAPI_TEST_KEY present (now populated, dedicated free-tier account karl.waldman+citests@). Apply same pattern to oilpriceapi-node, oilpriceapi-go, oilpriceapi-php.