Prefer OpenHarness-scoped API key env vars over provider globals

[siaochuan]

Summary

• prefer OPENHARNESS_* provider-scoped API key env vars over provider-native globals
• keep native provider env vars as fallback for compatibility
• forward the OpenHarness-scoped provider/auth env vars to spawned teammates
• add tests covering env precedence and teammate env propagation

Why

When multiple provider integrations are tested in the same shell, broad global env vars like ANTHROPIC_API_KEY and OPENAI_API_KEY are easy to mix up. This makes it too easy for OpenHarness to pick up the wrong credential from shared shell state.

This change gives OpenHarness a safer default path:

1. prefer project-scoped OPENHARNESS_* provider keys
2. fall back to provider-native env vars only when the scoped vars are absent

Related to #84.

Testing

• python -m pytest tests/test_config/test_settings.py tests/test_swarm/test_spawn_utils.py
• python -m pytest tests/test_auth/test_external.py -k third_party_base_url_for_claude_subscription