[rgarcia]

Summary

_run.yml's run job now declares environment: benchmarks, and the model provider keys move from repo secrets into that environment. Other workflows in this repo, such as ci.yml, can no longer read them.

• The environment has no protection rules or branch restriction, so dispatches from any branch still work.
• No AWS role trusts this environment.
• ANTHROPIC_API_KEY and OPENAI_API_KEY are set in the environment, as new keys tied to service accounts. OPENROUTER_API_KEY (the ClawBench judge) follows. Until then the job falls back to the org secret, so this is safe to merge first.
• The repo-level ANTHROPIC_API_KEY / OPENAI_API_KEY get deleted after a dispatch passes on the environment keys.

Testing

actionlint passes. Not run live: after merge, I'll dispatch a small kernel-mcp-clawbench run.

[rgarcia]

Picked AnnaXWang to review: no one has history here; lightest queue; nothing pending