[codex] Harden staging E2E credential loading

[haochencheng]

Summary

• add a staging E2E environment loader that reads credentials from Google Secret Manager without printing secret values
• keep local and staging E2E on explicit env/gateway overrides, while preserving staging-first public docs posture
• harden multi-SDK examples against staging response shape drift for pricing and service metadata
• record staging E2E readiness evidence and the current LLM upstream 404 blocker in docs/bugfix/staging-e2e.md

Security / redaction

• no private key, agent key, JWT, or Secret Manager payload is committed
• output/ remains ignored, so live E2E logs/screenshots are not tracked
• committed docs/scripts contain only env var names, Secret Manager resource names, and placeholder/test values
• helper filename is staging_env_loader.sh so repo hygiene does not flag it as a sensitive tracked filename

Validation

• git diff --cached --check
• staged sensitive-token scan for private keys, JWTs, agent keys, GitHub/OpenAI/Google-style tokens
• bash scripts/ci/repo_hygiene_checks.sh
• bash scripts/ci/security_checks.sh
• bash scripts/ci/pr_checks.sh

Staging E2E note

Five-SDK fixed-price staging smoke passed in run sdk-staging-sm-free-all-20260513-001646. The token-metered LLM path is still blocked by staging provider configuration: svc_deepseek_chat returns upstream HTTP 404. That blocker is documented in docs/bugfix/staging-e2e.md and was not masked by this change.