fix(core): treat empty apiKey as unset

[kvnloo]

Fixes #42790

Empty apiKey was treated as a configured credential: catalog available() enabled the provider for any string (including ""), and the session runner mapped "" through Auth.value(""), which fails auth apply instead of using Auth.none like an omitted key.

Only non-empty apiKey strings count as enablement/credentials now.

Test plan

• bun test test/catalog.test.ts test/session-runner-model.test.ts -t "missing and empty apiKey|empty configured apiKey|omitted apiKey" (fail on tip → pass on branch)
• Full catalog.test.ts + session-runner-model.test.ts (29 pass)

[github-actions]

This PR doesn't fully meet our contributing guidelines and PR template.

What needs to be fixed:

• PR description is missing required template sections. Please use the PR template.

Please edit this PR description to address the above within 2 hours, or it will be automatically closed.

If you believe this was flagged incorrectly, please let a maintainer know.

[github-actions]

This pull request has been automatically closed because it was not updated to meet our contributing guidelines within the 2-hour window.

Feel free to open a new pull request that follows our guidelines.