Credential-less provider profiles cannot be instantiated without a credential source

User Story

As an OpenShell user, I want to create a provider instance from a provider profile that declares no credentials, so that I can use the provider solely to distribute network access policies to sandboxes.
This is useful for internal services and public endpoints where authentication is not required, but where the provider profile is still useful for managing and attaching network policy.

Problem Statement

A valid provider profile with credentials: [] can be linted and imported successfully, but a provider instance cannot be created from that profile without supplying one of the credential-source options.
For example, a profile containing only a TCP endpoint and no credentials is accepted by the profile validation/import commands, but:
openshell provider create --name example --type example
fails because the CLI requires a credential source.
This prevents credential-less, policy-only provider profiles from being instantiated.

Impact / Why This Matters

Users who want to use provider profiles purely to distribute network policies must currently provide a credential source even when the provider profile does not require credentials.
As a workaround, users have to provide a dummy/fake secret when creating the provider instance.
This creates unnecessary configuration and makes the provider appear to have credentials when it does not actually require or use any.
For policy-only providers, this also makes it impossible to use the provider model as intended without introducing artificial credentials into the configuration.

Acceptance Criteria

• A provider profile containing credentials: [] can be instantiated without providing a credential source.
• The following command succeeds for a credential-less provider profile:

openshell provider create --name example --type example

• No dummy, fake, or otherwise unnecessary credential is required.
• The resulting provider instance can be attached to a sandbox.
• Endpoints defined by the provider profile are included in the sandbox's effective network policy.
• Existing provider profiles that require credentials continue to require their appropriate credential sources.

Reproduction Steps

Create /tmp/example-provider.yaml:

id: example
display_name: Example
description: Credential-less TCP access to example.com
category: other
inference_capable: false

credentials: []

endpoints:
  - host: example.com
    port: 443
    protocol: tcp

binaries:
  - /usr/bin/curl

2. Validate the profile

openshell provider profile lint -f /tmp/example-provider.yaml

Expected:

Provider profile lint passed.

3. Import the profile

openshell provider profile import \
  -f /tmp/example-provider.yaml

The profile is imported successfully.

4. Try to create a provider without credentials

openshell provider create \
  --name example \
  --type example

Actual result:

error: the following required arguments were not provided:
<--from-existing|--credential ...|--from-gcloud-adc|--runtime-credentials|--from-oidc-token>

The profile explicitly declares:

credentials: []

but the provider creation command still requires a credential-source option.

5. Workaround

The provider can only be created by supplying a credential source, for example by using a dummy/fake secret.

This is unnecessary because the provider profile itself declares that it has no credentials.

Environment

• OpenShell: 0.0.116
• OS: macOS 26.6.2
• Deployment: OpenShell gateway running locally, docker desktop 4.90.0, docker engine 29.7.2,
• Provider type: custom provider profile
• Provider profile: credential-less (credentials: [])
• Network policy: TCP endpoint example.com:443

Logs

$ openshell provider create --name example --type example

error: the following required arguments were not provided:
<--from-existing|--credential ...|--from-gcloud-adc|--runtime-credentials|--from-oidc-token>

Reproduce the behavior with the provider profile lint, import, and create commands shown in the issue, using a profile with credentials: []. Trace the provider creation entry point and its credential-source validation. Done means credential-less profiles can be created and attached to a sandbox while credentialed profiles still require their configured source and endpoints remain in the effective network policy.