Deleting an APIKey's Secret does not revoke the key #6

Problem

A missing Secret, missing key or empty value makes render fail, and Assemble then keeps the served entry (assemble.go#L188-L198). For an APIKey, the old key_hash keeps authenticating.

Reproduce

• Delete the APIKey's Secret (or remove its key, or empty the value) and reconcile: the written file still holds the old key_hash. Status shows Accepted=False with the Secret error and Programmed=False "the previously accepted version keeps serving".
• Rotation variant: with a spec the gateway rejects, changing the Secret value keeps the old key served and never serves the new one.

Impact

A credential the operator meant to revoke keeps working with its old allowed_models, with no time limit. Deleting the APIKey CR does revoke (e2e case 7), but removing a credential's Secret is a natural Kubernetes and GitOps way to revoke.

Scores

Scores are out of 10. Higher is worse for likelihood and severity. Higher is better for mitigations, detectability, test coverage and cost vs benefit (10 = cheap fix, high value).

Fix

• APIKey, fail closed: when the credential can't be resolved, mark it Rejected with no fallback. When an APIKey falls back for any other reason, keep the served entry only if its key_hash equals the hash of the current Secret value.
• ProviderKey, keep Retained: dropping it would take down every Model on it; the upstream provider is where an upstream key is revoked. Log the case.
• Document both behaviours in the README.

Tests to add

Secret deleted, key removed and value emptied all give Rejected; rotation while rejected gives Rejected; a ProviderKey with its Secret deleted stays Retained.