platform-server env cleanup: LiteLLM-only, remove GitHub env creds, refactor nix resolve-repo (no GitHub API), remove debug/safety flags

[rowan-stein]

User request\nClean env variables used by platform-server. Specifically:\n- Remove OpenAI provisioner support (LiteLLM only).\n- Use a simple hardcoded LiteLLM key alias/string (e.g. ).\n- Remove global GitHub credentials usage from env (no Octokit initialized with static env vars; workspace should not inject global token).\n- Refactor Nix repo resolution so it does not query GitHub API and does not require a token (public repos only).\n- Remove "Debug / safety" env vars and associated logic.\n\n## Spec / notes\n- currently selects between and in ; OpenAI provisioner exists at .\n- GitHub env vars are read in and used to init Octokit in ; also used by and injected into workspaces in .\n- UI calls from .\n- Proposed new backend: resolve ref->SHA via and verify flake via (no api.github.com).\n\nAcceptance:\n- platform-server boots and tests pass.\n- README/.env examples updated to remove deleted vars and reflect public-repo-only Nix resolve.\n