fix(shell): turns read the auth scheme and BYOK status from the live catalog

reconstruct_full_config and the subagent spawn resolved both from a disk reload
that never holds fetched entries, so a fetched Messages model (anthropic,
minimax) went out with Authorization: Bearer instead of x-api-key.

crates/codegen/kigi-shell/src/agent/config.rs

@@ -3960,6 +3960,18 @@ pub fn resolve_model_auth_facts(model_id: &str) -> ModelAuthFacts {
         },
     })
 }
+/// Auth facts of a catalog entry the caller already holds. A fetched entry
+/// exists only in the live catalog, never in a disk reload.
+pub(crate) fn auth_facts_of(entry: &ModelEntry) -> ModelAuthFacts {
+    ModelAuthFacts {
+        byok: if entry.has_own_credentials() {
+            ModelByok::Byok
+        } else {
+            ModelByok::NotByok
+        },
+        auth_scheme: entry.info().auth_scheme,
+    }
+}
 fn byok_from_lookup(lookup: &ModelLookup) -> ModelByok {
     match lookup {
         ModelLookup::ConfigUnavailable => ModelByok::Unknown,
@@ -5274,6 +5286,17 @@ reasoning_effort = "low"
             auth_scheme: Default::default(),
         }
     }
+    /// A fetched entry's scheme and BYOK status come from the entry itself.
+    #[test]
+    fn auth_facts_come_from_the_held_entry() {
+        let mut model = test_model_entry("claude-x", "https://gw.example/v1", None, None, None);
+        model.info.auth_scheme = AuthScheme::XApiKey;
+        let facts = auth_facts_of(&model);
+        assert_eq!(facts.auth_scheme, AuthScheme::XApiKey);
+        assert_eq!(facts.byok, ModelByok::NotByok);
+        model.api_key = Some("sk-own".into());
+        assert_eq!(auth_facts_of(&model).byok, ModelByok::Byok);
+    }
     #[test]
     fn x_api_key_auth_scheme_flows_from_config_to_sampler() {
         let mut model = test_model_entry(

crates/codegen/kigi-shell/src/agent/subagent/mod.rs

@@ -897,9 +897,17 @@ async fn read_parent_sampling_config(
                 creds.alpha_test_key.as_deref(),
                 &cfg.base_url,
             );
-            let auth_scheme = crate::agent::config::try_resolve_model_credentials(&cfg.model, None)
-                .map(|r| r.auth_scheme)
-                .unwrap_or_default();
+            let auth_scheme = crate::agent::models::entry_for_slug(
+                &ctx.available_models,
+                Some(ctx.model_id.0.as_ref()),
+                &cfg.model,
+            )
+            .map(|entry| crate::agent::config::auth_facts_of(entry).auth_scheme)
+            .or_else(|| {
+                crate::agent::config::try_resolve_model_credentials(&cfg.model, None)
+                    .map(|r| r.auth_scheme)
+            })
+            .unwrap_or_default();
             // Claude Pro/Max OAuth Messages adaptation inherits from the parent
             // model's platform (claude-pro-max → true); every other platform,
             // and BYOK, → false, so the API-key paths stay byte-identical.