Add TYPESAFEAI_API_KEY to the encrypted global-env file and declare OPENCODE_API_KEY, which was encrypted but never wired into globalEnvironmentSecretNames.