fix(triage): only pass OPENAI_API_KEY when enabled or manually dispatched

The pull_request_target / issues auto-triggers always passed the LLM API
key, and AGENT_SHIN_ENABLED only gated --close. In dry-run mode the
script still calls the model whenever the key is present, so an
external user could open/reopen PRs or issues with large bodies to drain
LLM credits before the bot was ever enabled.

Bind OPENAI_API_KEY to the empty string unless AGENT_SHIN_ENABLED is
'true' (workflow has opted in to model costs) or the workflow is
running via workflow_dispatch (requires write access — collaborator
only). The script already short-circuits with skip-no-llm-key when the
key is empty, so the pre-enable rollout path for manual QA via 'gh
workflow run' still works for collaborators, but auto-triggered runs
from external authors cannot spend credits.

.github/workflows/triage_issue_with_llm.yml

@@ -49,7 +49,15 @@ jobs:
       - name: Run Agent Shin
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+          # Only expose the LLM key when the workflow is actually allowed to
+          # take action (AGENT_SHIN_ENABLED=true) or when a collaborator runs
+          # it manually via workflow_dispatch (write access required to
+          # trigger). On the public issues path while the bot is not yet
+          # enabled, the key is intentionally absent so the script
+          # short-circuits with skip-no-llm-key — otherwise an external user
+          # could open/reopen issues with large bodies to force paid LLM
+          # calls.
+          OPENAI_API_KEY: ${{ (vars.AGENT_SHIN_ENABLED == 'true' || github.event_name == 'workflow_dispatch') && secrets.OPENAI_API_KEY || '' }}
           OPENAI_BASE_URL: ${{ vars.OPENAI_BASE_URL }}
           TRIAGE_MODEL: ${{ vars.TRIAGE_MODEL }}
           AGENT_SHIN_ENABLED: ${{ vars.AGENT_SHIN_ENABLED }}

.github/workflows/triage_pr_with_llm.yml

@@ -60,7 +60,14 @@ jobs:
       - name: Run Agent Shin
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+          # Only expose the LLM key when the workflow is actually allowed to
+          # take action (AGENT_SHIN_ENABLED=true) or when a collaborator runs
+          # it manually via workflow_dispatch (write access required to
+          # trigger). On the public pull_request_target path while the bot is
+          # not yet enabled, the key is intentionally absent so the script
+          # short-circuits with skip-no-llm-key — otherwise an external user
+          # could open/reopen PRs with large bodies to force paid LLM calls.
+          OPENAI_API_KEY: ${{ (vars.AGENT_SHIN_ENABLED == 'true' || github.event_name == 'workflow_dispatch') && secrets.OPENAI_API_KEY || '' }}
           OPENAI_BASE_URL: ${{ vars.OPENAI_BASE_URL }}
           TRIAGE_MODEL: ${{ vars.TRIAGE_MODEL }}
           AGENT_SHIN_ENABLED: ${{ vars.AGENT_SHIN_ENABLED }}