Function MakeAIAPIKeyResolver

Builds an AIAPIKeyResolver over a runtime key list: the list's key for the driver class first, then the platform (environment) key — the same precedence as GetAIAPIKey. For prompts that is only the legacy tier: AIPromptRunner tries MJ Credentials first (a per-request credentialId, then AICredentialBindings, then the vendor's default credential) and reaches this order only when none of them resolves. This resolver never consults credentials.

Pass the run's apiKeys and the resolver honours a customer's own credentials; pass nothing and it is exactly the platform lookup, so a caller never has to special-case "this run has no keys".

A caller with its own platform-key seam should layer run keys over that seam rather than use this resolver, whose environment fallback would answer first and bypass the seam.