[FEATURE] Cleanup magic flags for `olmobase:code`

[davidheineman]

Feature Description

One issue I had running olmobase:code was onboarding with the proper GCS keys. (it was unclear my service credentials didn't have access, or how to get creds).

And, I had to use a few magic flags to get things running:

    -H codex_universal \
    -o provider.num_instances=4 \
    -o 'sandboxes.0={"mode":"modal","instances":96,"registry_auth":{"provider":"gcp"}}' \
    --secret-env ai2-tylerm_MODAL_TOKEN_ID:MODAL_TOKEN_ID \
    --secret-env ai2-tylerm_MODAL_TOKEN_SECRET:MODAL_TOKEN_SECRET \
    --gcp-credentials

It would be great if these options were fold-ed into the default behavior! (similar to our setup in oe-eval-internal)

Proposed Solution

@undfined and I chatted briefly about this, I think he had some ideas. Seems like handling this similar to the AWS credentials might be a nice option