Remove paid benchmark CI and retire API credentials; stabilize offline CI #1129

Remove paid benchmark workflows and retire their credentials from this public repository, while retaining offline CI and manual benchmarking. Stabilize the existing CI failures without weakening their assertions. Split from #1128.

Reviewed baseline: 6b1a253cfc3290bf04d9e530554a46192611bf19.

The selected approach is to remove paid evaluation from this repository's Actions, rather than adding an approval environment or a budget gateway. Ordinary CI remains available without provider credentials. Manual benchmark tooling remains available to maintainers in a controlled, isolated environment.

• Prevent new paid launches first. Disable the benchmark producer and cancel queued/running benchmark Actions. Recheck the old queued manual run, reported queued on September 22, 2026; do not assume it is the only outstanding work.
• Retain trusted cleanup tooling and Modal access until detached sandboxes and builds have been located and stopped. Cancelling an Actions run or deleting a secret does not establish that remote compute has stopped. Record any unresolved remote cleanup before retiring that access.
• Remove .github/workflows/eval-benchmarks.yml, .github/workflows/eval-benchmark-recovery.yml, and .github/workflows/eval-history-publication.yml after the necessary shutdown steps. Remove their automatic/manual launch and follow-on publication paths.
• Remove this repository's provider API, Modal, and unused benchmark-reporting secrets. Check repository, environment, and organization access so another workflow or an old ref cannot recover the same credentials through a different scope. Revoke dedicated CI credentials at their providers; deleting Actions secrets alone does not revoke copies already issued. If a credential is shared with another workload, identify its owner and replace it there before retiring the old key.
• Retire the eval-history publisher App key, configuration variable, and repository access/bypass permissions if dedicated and no longer used. Do not remove shared App installations or credentials needed elsewhere.
• Update or remove tests that require the deleted workflows, including relevant cases in packages/modal/test/ci-config.test.ts, scripts/ci/verify-cohort-reachability.test.ts, and scripts/ci/validate-threat-model-benchmark-gate.test.ts. Retain useful runtime, configuration, security, and manual-run tests. Remove orphaned CI-only helpers only after checking for manual-tooling consumers.
• Update eval how-to documentation and any remaining CI descriptions to explain explicitly initiated maintainer runs and manual result publication. Remove claims that every main push runs a paid benchmark or automatically updates history.
• Preserve .github/workflows/ci.yml, builds, lint, advisory/static checks, automated tests, and offline benchmark-history consistency checks. Preserve the benchmark engine, CLI/Modal support, datasets, prior result bundles, and charts. The tradeoff is that new benchmark results and regressions require an explicitly initiated run.
• Verify the remaining Actions contain no paid launch path and have no usable provider/Modal credentials. Run the remaining CI checks and confirm that benchmark workflow removal does not produce missing-file failures or stale required-check configuration.

Also repair the existing offline CI failures:

• Fix the OpenRouter retry/resume test's live diagnostic dependency. In the failed CI run, the diagnostic /models request took 2.511 seconds inside a two-second caller deadline, so the second fixture process never started. Make diagnostics deterministic/offline and synchronize the fixture while retaining the assertions that retry/resume happens and the caller deadline terminates the resumed child.
• Diagnose and stabilize the multi-provider credential-isolation test's 120-second timeout on main. The precise slow phase is not yet established; the same test passed in 16.3 seconds in another run. Separate heavyweight controller preparation/forwarding coverage from focused Bun generated-adapter isolation assertions where appropriate, and add reliable subprocess termination/reaping. Keep the checks that each provider child receives only its own credential. Do not mask either CI failure by merely raising the job timeout or removing assertions.

Acceptance: the repository has no paid benchmark Actions launch path or usable provider/Modal CI credentials; detached benchmark work is stopped or explicitly accounted for; the remaining CI and manual tooling tests pass. Record any provider-side revocation or shared-account cleanup that requires account-owner access.