Refuse to start the built-in Bot without a model key, so the healthcheck stops passing a Bot that cannot answer

[jeonjw85]

Closes #98.

What this changes

The built-in Bot now refuses to start when OPENAI_API_KEY is missing or empty, the same posture the LangGraph Bot already has and the same file already applies to MANAGED_AGENT_TOKEN. Until now it started, answered the healthcheck, and then failed every conversation, so a missing key looked like a healthy deployment: compose reported Up (healthy) for the built-in Bot while the LangGraph Bot sat at Exited (1) for the same missing variable.

The check runs at startup rather than on the first run, so the failure lands in front of whoever is deploying. Two tests spawn the real entrypoint with the environment compose hands it (an unset key arrives as an empty string through ${OPENAI_API_KEY:-}) and pin both refusals.

Where it runs

• New state that outlives a request? None. A startup check and an exit; nothing stored.
• What happens on the second replica? Each replica runs the same check and refuses identically. Nothing is shared, so there is nothing to disagree about.
• Anything serialised? No.
• Anything fanned out to a browser? No.
• New listener, port, or schedule? No. If anything the change stops the Bot listening when it has nothing to answer with.

Boundary and audit

• Every acting call still goes through the gateway: unchanged.
• New refusals and new failures each write a row: the refusal is a process that exits at startup and names the missing variable, the same shape as the existing token refusal. A container that never came up is the record.
• Nothing new is trusted from the client that the server can resolve itself.

Changelog

• A line in CHANGELOG.md under Unreleased, in Upgrading: a deployment that ran the built-in Bot without a key now sees it refuse to start instead of reporting healthy.

Verification

• bun test tests/agent-bot.test.ts: 2 pass.
• Full suite from the repo root: 1007 pass, 5 skip, 0 fail across 100 files.
• bunx biome format and bunx biome lint clean on the changed files; tsc --noEmit --strict clean on both.
• The CI test job gains one install step: agent-bot keeps its own lockfile and is not a root workspace, and the new tests spawn its real entrypoint.