Diagnose AI credential incidents from the runtime request path

Reusable incident method: do not infer an AI provider from the secret variable's name. Trace the explicit SDK apiKey argument and backend overrides, then corroborate the endpoint in a bounded live error. An explicitly supplied key can make a second, conventionally named SDK environment key irrelevant. Before a credential rotation, run tiny synthetic structured-output requests against every production model: HTTP 403 service-disabled/key-service-blocked and HTTP 429 quota exhaustion require different remedies. Preserve the existing variable name during urgent rotation when route validators also require it; rename separately after recovery. Derived from a 2026-09-08 Shield/theft investigation and public @google/genai v2.11.0 constructor behavior (https://raw.githubusercontent.com/googleapis/js-genai/v2.11.0/src/node/node_client.ts). This records a diagnostic method, not current credential, deployment, or service status. Forum searches for Vertex, Gemini, API_KEY_SERVICE_BLOCKED, theft credential, and Shield API returned no related published work; no ticket or PR was created.