test(ai): live media-input integration tests per provider, runnable from GitHub Actions

[ling-senpeng13]

What

Live-API regression coverage for the provider media-input fixes (#1238 Anthropic, #1241 Gemini, #1243 Grok/Perplexity, #1246 Cohere) plus live locks for the pre-existing OpenAI-family media path — runnable from GitHub using the org-level provider secrets.

• testChatCompletionWithImageMedia added to the key-gated live nests of AnthropicTest, GrokTest, PerplexityAITest, OpenAITest, AzureOpenAITest; new ApiKeyIntegrationTests nest in GeminiVertexTest (AI-Studio mode, GEMINI_API_KEY — the mode the server uses via conductor.ai.gemini.api-key); new BearerIntegrationTests nest in BedrockTest (AWS_BEARER_TOKEN_BEDROCK, matching the server's conductor.ai.bedrock.bearerToken — separate from the access-key nest because the CI AWS keys are provisioned for artifact publishing). CohereAITest already had the equivalent test from fix(ai): attach user media for Cohere (vision) requests #1246.
• Each test sends the repo's deterministic token image (MELON7391, ai/src/test/resources/media/melon7391.png) to a vision-capable model and asserts the token is transcribed — a pass proves the adapter actually attached the media; the token cannot be answered by luck (pattern from test(e2e): Python media-input suite (image → vision model) agentspan-ai/agentspan#301).
• New workflow llm-media-integration.yml: weekly cron + workflow_dispatch + PR runs when the workflow file changes. Publishes a per-provider JUnit report ("LLM Media Integration Report").

Results (this PR's workflow run — live APIs, org secrets)

Provider	Model	Result
Anthropic	claude-haiku-4-5	✅ pass
OpenAI	gpt-4o-mini	✅ pass
Azure OpenAI	gpt-4o-mini deployment	✅ pass
Gemini	gemini-2.5-flash (AI Studio)	✅ pass
Grok	grok-4.5	✅ pass
Perplexity	sonar	✅ pass
Bedrock	us.anthropic.claude-haiku-4-5-20251001-v1:0 (bearer auth)	✅ pass
Cohere	command-a-vision-07-2025	⏭ skipped — no COHERE_API_KEY org secret; activates automatically once added

8 tests run, 7 passed, 1 skipped, 0 failed.

Fixes folded in along the way

• Grok env-var mismatch: the org secret and tests use GROK_API_KEY, but the server bound only XAI_API_KEY. application.properties now falls back ${XAI_API_KEY:${GROK_API_KEY:}}, so either name configures the provider (XAI wins when both are set).
• Bedrock model-id lessons (discovered by the live runs, encoded as comments): bare model ids are rejected for on-demand throughput — inference-profile ids (us. prefix) are required; and claude-3-haiku is provider-Legacy and blocked after 30 days of inactivity. The pre-existing access-key-gated Bedrock chat test was updated to the current Haiku 4.5 profile id accordingly.
• Stale Gemini model in the Vertex live test: gemini-1.5-flash → gemini-2.5-flash.

Budget control — when the paid tests run (and don't)

Live provider calls cost real money, so the triggers are deliberately narrow:

• Unrelated changes never trigger a run. The pull_request trigger is path-filtered to the workflow file itself and ai/src/main/java/org/conductoross/conductor/ai/providers/** — the exact code these tests exist to guard. A PR touching anything else in the repo spends nothing.
• Fork PRs structurally cannot spend: GitHub withholds org/repo secrets from fork-originated runs, so every key-gated test reports SKIPPED.
• Rapid pushes don't stack runs: a concurrency group (llm-media-${{ github.ref }}, cancel-in-progress: true) cancels superseded runs.
• Per-run cost is bounded: fixed 8 tests, maxTokens(100), one ~3.5 KB image — roughly 8 calls × ~300 tokens, i.e. a fraction of a cent per run.
• Scheduled spend: weekly cron (30 5 * * 1 UTC) — pennies per year; plus on-demand workflow_dispatch.

If stricter control is ever wanted, the next steps are a PR label gate (run only with a run-llm-tests label) or moving the secrets behind a protected GitHub environment with required reviewers, which also gates cron and manual dispatches behind human approval.

Not covered — no org-level key configured ✘

These providers have no secret at the org level, so their live coverage cannot run in CI at all:

• MISTRAL_API_KEY — MistralAITest.IntegrationTests exists but can never run in CI until a key is added.
• COHERE_API_KEY — the Cohere live tests (adapter integration test from fix(ai): attach user media for Cohere (vision) requests #1246 + the row in this suite) stay dormant; they activate automatically, zero code changes, the moment the secret is added.
• HUGGINGFACE_API_KEY — HuggingFaceTest's key-gated live nest likewise can never run in CI.
• STABILITY_API_KEY — no key, so no live Stability coverage is possible in CI (image-generation provider; not part of the media-input fix series).

Follow-ups (not in this PR)

• Add COHERE_API_KEY as an org secret (org admin) to activate the Cohere row — no code change needed.
• Optionally provision MISTRAL_API_KEY / HUGGINGFACE_API_KEY / STABILITY_API_KEY the same way; the existing key-gated nests pick them up automatically.