Finds the API keys an agent's code calls services with. Implements WardrikCore.Keys.

Keys are secrets in the vault. Wardrik looks in this order:

1. The person, for a person's agent.
2. The org.
3. The deployment.

An org or person brings its own key by sealing a secret with the key's name:

Wardrik.put_secret(MyApp.AgentRuntime, "acme", "ZAI_API_KEY", key)

If no one holds it, the code finds its own, as ReqLLM reads the environment. Only secrets count. A connected account is a credential, never a key.