The pi and opencode key lists are copied into four launchers #2534

Problem

The list of keys pi and opencode need (NAN_API_KEY,OPENROUTER_API_KEY, plus OPENAI_API_KEY for opencode) is written in four places: pi() and opencode() in .bashrc (lines 117-118), the PowerShell wrappers in powershell/profile.ps1 (around line 321 and 340), and, since #2532, the pi entry of the launch table in cli/internal/lane/launch.go. A key added to one is silently missing from the others, and a launch through the table (a lane successor) is the one nobody sees until the agent fails to authenticate.

Shape

One source (the secrets registry already knows which ids an agent needs, or a small per-agent table in Go) read by the shell wrappers and by lane exec alike, e.g. a dotf agent env <name> that prints the --only list. Per ADR-020 the wrappers shrink to one call.

Evidence

2026-10-14: lane exec --agent pi with the bare binary started pi without its keys; the wrapper function carries them and exec skips functions (lesson 438).