Add OpenAI GPT-Rosalind as the rosalind deep-research provider

[realmarcin]

Summary

Adds OpenAI GPT-Rosalind as a TraitMech deep-research provider, rosalind
(aliases gpt-rosalind, gpt_rosalind), for reviewing and constructing causal
graphs and their evidence.

GPT-Rosalind is served by the same Responses API as deep-research-client's
openai provider, so the lane is --provider openai --model $ROSALIND_MODEL
under a TraitMech-level provider name and its own filename namespace,
<slug>-deep-research-rosalind.md. The namespace is deliberately separate from
-openai: an o3-deep-research report and a GPT-Rosalind report are different
evidence and must never satisfy each other's resume check.

What changed

• scripts/research_trait.py: rosalind provider; provider_args() emits
  --provider openai --model …; research_env() lets a dedicated
  ROSALIND_API_KEY override OPENAI_API_KEY for this lane (a
  general-purpose key must not silently take the call); research_env() now
  accepts an injected environ.
• scripts/run_trait_graph_audit.py: provider-aware preflight (it used to demand
  EDISON_API_KEY for every provider); resume and the orphan gate honour a
  pipeline_run: false front-matter flag, which is what keeps the two
  hand-pasted Rosalind answers under research/traits/ecology/ from suppressing
  a --provider rosalind call or being reported as orphans.
• scripts/deep_research_provider.py + conf/deep_research_provider.yaml:
  rosalind triaged and credentialed on its own, weighted like falcon for
  causal_mechanism.
• scripts/research_rosalind_canary.py + just rosalind-canary: unbilled
  preflight. Lists the models the credential may use and fails unless the
  requested id is among them (the model is trusted-access gated per org), prints
  any Rosalind ids it does see so ROSALIND_MODEL can be corrected, then checks
  deep-research-client discovers openai under the env a real run gets.
  Lives outside deep_research_contract.py because that file is vendored.
• scripts/render_trait_pages.py: RESEARCH_PROVIDERS = ("falcon", "rosalind")
  (no page changes: both existing Rosalind traits also have falcon reports).
• Docs: docs/DEEP_RESEARCH_PROVIDERS.md, README, the research-causal-graphs
  skill, .env.example; the two hand-supplied reports' front matter now says why
  pipeline_run: false is load-bearing.
• Tests for every seam above.

Verified

• just qc green, full pytest suite green (see the PR comments for counts).
• just research-trait ecology gut_associated --provider gpt-rosalind --dry-run
  emits --provider openai --model gpt-rosalind and the -rosalind.md path.
• run_trait_graph_audit.py --provider rosalind --dry-run/--verify: 0 done,
  0 orphans (the two hand-supplied files are correctly excluded).
• just rosalind-canary runs and fails cleanly on the credential check on the
  authoring machine (no Rosalind key was visible to the session).

Not verified (needs the key)

• The exact API model id. Default is gpt-rosalind; the canary reports the
  real ids and ROSALIND_MODEL overrides. No paid call has been made.
• Which variable carries the key: ~/.secrets held OPENAI_API_KEY at the
  start of the session and only CODEX_ACCESS_TOKEN a few minutes later.
  The lane reads ROSALIND_API_KEY first, then OPENAI_API_KEY.

🤖 Generated with Claude Code

https://claude.ai/code/session_01X8fGq86Bo7eeBoXMtiU1gg

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[realmarcin]

Adversarial review: findings filed and triaged

Every finding from the review pass was filed as an issue. Disposition for this PR:

Fixed in this PR (second commit)

• rosalind run overwrites the hand-pasted Rosalind reports in place #638 rosalind run overwrote the hand-pasted reports. research_trait.py now refuses any existing report at the output path without --force, and the sweep sets hand-supplied targets aside with their own count instead of queueing them.
• Test forbids any pipeline-written rosalind report, so the lane's first real report breaks CI #639 test forbade any pipeline-written rosalind report. Replaced by the orphan-gate invariant, so the first real report with its ok row stays green.
• Passthrough --model can write another model's report into the rosalind namespace #640 passthrough --model could poison the namespace. Rejected for rosalind with a pointer to ROSALIND_MODEL.
• A bare OPENAI_API_KEY makes rosalind 'configured' and routes causal-mechanism triage to it #641 bare OPENAI_API_KEY configured rosalind and re-routed triage. ROSALIND_API_KEY is now the lane's only credential everywhere (runner, sweep preflight, triage, canary); without it the child process gets no OpenAI key at all. Verified the causal_mechanism route with EDISON_API_KEY+OPENAI_API_KEY is identical to main again.
• is_pipeline_report: 4096-char probe and lowercase-only regex misclassify hand-supplied reports #642 4096-char probe and lowercase-only regex. Front matter is parsed as YAML (research_trait.front_matter), BOM-tolerant, whole file. Tests cover False/no/late flag/BOM and the quoted-string non-match.
• Renderer ranks hand-pasted rosalind files as tracked-sweep reports #643 renderer promoted hand-pasted files. research_report() excludes pipeline_run: false; renderer test added.
• ROSALIND_MODEL from .env is invisible to a bare uv run sweep; docs show the bare form #644 ROSALIND_MODEL invisible to a bare uv run. Docs now show just trait-graph-sweep for every sweep example and say why.
• Sweep preflight table omits EDISON_PLATFORM_API_KEY and duplicates two other credential tables #646 preflight table missed EDISON_PLATFORM_API_KEY. Added, with a test case. The table dedup across three modules is left open on the issue.

Deferred, left open

• Rosalind canary: model id unverified and request shape not exercised #645 model id and request shape are unverifiable without the key. Added --allow-unlisted to the canary as the documented escape and wrote the caveat into the docs; the remaining work is one real run with the key, which is a paid call and needs an explicit go-ahead.
• uv.lock cannot sync on macOS x86_64: llvmlite 0.48.0 (via pacmap -> numba) ships no Intel Mac wheel #637 (not from the review): uv.lock cannot sync on Intel Macs. Pre-existing, unrelated to this PR.

🤖 Generated with Claude Code

https://claude.ai/code/session_01X8fGq86Bo7eeBoXMtiU1gg