V2 runner sends a non-credential env var as the bearer API key for env-configured providers

Description

models.dev lists a provider's env vars in setup order, e.g.
cloudflare-workers-ai: ["CLOUDFLARE_ACCOUNT_ID", "CLOUDFLARE_API_KEY"].
The integration layer registers that list verbatim and connection resolution picks the
first set var as the credential, so with the standard two-var setup the account id is
sent as Authorization: Bearer <account-id> → every request fails with Cloudflare's
{"code":10000,"message":"Authentication error"}.

Same shape for:

#43077 fixed this class for google-vertex only (v2 branch); these four are still
unfiltered on both dev and v2. v1 is unaffected — its loader picks
CLOUDFLARE_API_KEY explicitly and refuses to derive a key when several vars exist.

Suggested fix: when registering the integration's env method, keep only
credential-shaped names (*_API_KEY, *_TOKEN, *_PAT) if any match, falling back to
the full list otherwise. I have a fix and tests, opening a PR against this.

Plugins

No response

OpenCode version

dev @ 1.18.21 (also reproducible on the v2 branch)

Steps to reproduce

1. export CLOUDFLARE_ACCOUNT_ID=<id> and export CLOUDFLARE_API_KEY=<key> (no stored auth)
2. Start opencode in any project
3. Select a cloudflare-workers-ai/* model and send any prompt
4. Every request returns 401 {"code":10000,"message":"Authentication error"};
   the outbound request carries Authorization: Bearer <ACCOUNT_ID> instead of the key

Screenshot and/or share link

No response

Operating System

No response

Terminal

No response