fix(core): treat empty apiKey as unset

[kvnloo]

Issue for this PR

Closes #42790

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

Empty apiKey: "" was treated as a real credential string — catalog marked credentialless providers available, then auth apply used Auth.value("") instead of Auth.none (same as omitted). Treat empty as unset in catalog.available() and session runner apiKey().

How did you verify your code works?

Bare dev tip (88c6c7a): typeof apiKey === "string" enables empty and Auth.value("") on apply — empty/missing suite absent / tip semantics FAIL. On this branch:

cd packages/core && bun test test/catalog.test.ts test/session-runner-model.test.ts \
  -t "missing and empty apiKey|empty configured apiKey|omitted apiKey"

3 pass. Full catalog.test.ts + session-runner-model.test.ts: 29 pass, 0 fail.

Screenshots / recordings

n/a (non-UI)

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

[kvnloo]

Shepherd note

Tip f8fbc92 (base dev) — full-template re-open of the empty-apiKey leaf after #49215 auto-close.

• packages/core/src/catalog.ts — non-empty apiKey for available()
• packages/core/src/session/runner/model.ts — value !== "" before Auth.value
• live: bun test test/catalog.test.ts test/session-runner-model.test.ts -t "missing and empty apiKey|empty configured apiKey|omitted apiKey" → 3/3 pass
• CI: pr-standards / compliance / duplicates success; typecheck + test show action_required (likely first-time / fork workflow approval) — watching

Happy to help land once checks are unblocked. Fixes #42790 / PER-1701.