secrets: remove hardcoded OmniRoute API key, source from env

chore(security): set visibility to private, sanitize internal Tailscale IPs, and drop qa_evidence tracking

test(music): add objective vocal-alignment probe to the A/B harness

test(music): authenticate ZeroGPU calls and send lyrics in the probe

test(music): add A/B comparison harness for the 3 test-song WAVs

test(music): log probe outcomes to probe_history.log

test(music): add ZeroGPU smoke-test runner with quota probe

fix(hub): add model alias resolution and persist canonical ibrowse qa evidence

feat(workflows): add OmniRoute summarization, transcription, search, extraction

feat(agentic): add offline test suite, agent contracts, and unified verification runner

fix: require auth only when FLOW_API_KEY is explicitly set