feat: support OpenAI-compatible model endpoints

[eshulman2]

Summary

• add an openai-compatible model backend for orchestration and sandbox agents
• support multiple named endpoints with per-connection base_url and environment-backed api_key_env credentials
• keep credential values out of model policy, traces, task files, and logs
• support unauthenticated endpoints and legacy OPENAI_BASE_URL / OPENAI_API_KEY configuration
• document configuration and add Chat Completions/tool-calling contract coverage

Testing

• uv run pytest tests/unit -q (2202 passed)
• Ruff checks for all changed Python files
• git diff --check