feat: complete evidence restructuring worktree

backend/test/pi-process-manager.test.ts

@@ -22,7 +22,7 @@ const SAFE_AUTH = '{"deepseek":{"type":"api_key","key":"safe-token"}}\n';
 const SAFE_MODELS = [
   "{",
   '  "providers": {',
-  '    "local-qwen": {"baseUrl":"http://model.invalid/v1","models":[{"id":"qwen"}]}',
+  '    "local-qwen": {"baseUrl":"http://model.invalid/v1","apiKey":"local","models":[{"id":"qwen"}]}',
   "  }",
   "}",
   "",
@@ -670,9 +670,22 @@ test.each([["OpenAI", "openai"], ["gemini", "google"]])(
   },
 );
 
-test.each(["ollama", "local-qwen"])(
-  "local provider %s spawns without a model key and scrubs ambient credentials",
+test.each(["installation-local", "private-compatible"])(
+  "provider %s configured with a literal apiKey spawns without a managed key",
   async (provider) => {
+    const root = mkdtempSync(path.join(tmpdir(), "tht-local-provider-"));
+    const agentDir = path.join(root, "agent");
+    mkdirSync(agentDir, { mode: 0o700 });
+    writeFileSync(path.join(agentDir, "models.json"), JSON.stringify({
+      providers: {
+        [provider]: {
+          baseUrl: "http://model.invalid/v1",
+          apiKey: "local",
+          models: [{ id: "model" }],
+        },
+      },
+    }), { mode: 0o600 });
+    vi.stubEnv("PI_CODING_AGENT_DIR", agentDir);
     vi.stubEnv("PI_PROVIDER_API_KEY", "ambient-secret");
     vi.stubEnv("THT_MODEL_API_KEY_FILE", "/ambient/secret-path");
     vi.stubEnv("OPENAI_API_KEY", "unselected-provider-secret");
@@ -690,6 +703,7 @@ test.each(["ollama", "local-qwen"])(
     } finally {
       mgr.teardown(`local-session-${provider}`);
       vi.unstubAllEnvs();
+      rmSync(root, { recursive: true, force: true });
     }
   },
 );