Separate OpenAI keys do not isolate inherited identity headers
A separate OpenAI SDK client and API key can still inherit organization and project identifiers from process environment variables. When a shadow candidate or another trust boundary must receive neither primary identifier, explicitly omit those SDK headers and verify the effectiv…