gateway: silent-fallback hardening in crates/zeroclaw-gateway/src/lib.rs (follow-up to #6099)

[perlowja]

Tracking issue per @WareWolf-MoonWall's merge-condition on #6099.

What's still silent after #6099

#6099 (`fix(config): preserve user-supplied providers.fallback through load/save`) hardens the runtime-side credential resolution with the fail-loud / sentinel split — but the gateway-side resolution path in `crates/zeroclaw-gateway/src/lib.rs` still falls back silently when a profile-resolved credential is unavailable. Same problem space as the runtime fix; different surface.

This is the merge-condition WareWolf-MoonWall flagged on #6099: gateway-side hardening must be tracked before the runtime-side fix lands so the asymmetric remediation isn't forgotten.

Fix shape

Mirror the runtime-side pattern from #6099:

1. Fail-loud: when a fallback provider is requested but no profile-resolved credentials exist, return a structured error to the gateway caller rather than silently using an empty/sentinel credential.
2. Sentinel split: distinguish "no credential intentionally" (gateway runs anonymously by design) from "credential resolution failed" (operator misconfiguration).
3. Operator-actionable error: include the provider name, the resolved profile, and the credential field that failed to resolve.

Scope

• File: `crates/zeroclaw-gateway/src/lib.rs` — the credential resolution call sites adjacent to `fallback_providers` lookup.
• Channels-side similar paths can travel with this PR (per @WareWolf-MoonWall's "channels sites can travel with it" note).

Cross-references

• Runtime-side fix: fix(config): preserve user-supplied providers.fallback through load/save #6099
• Adjacent issue: fix(providers): read api_key, base_url, and name from config for fallback providers #6092 (`[reliability].fallback_providers` chain entries not picking up profile-resolved credentials)

cc @WareWolf-MoonWall @singlerider — opening this so #6099 can merge cleanly.

[Audacity88]

Triage Summary

Type: Enhancement
Priority: Medium
Area: gateway, security
Risk: Medium

Summary: Gateway-side fallback credential resolution silently uses empty/sentinel credentials when a profile-resolved credential is unavailable. Mirrors the runtime-side fix from #6099 to the gateway surface. Filed as a merge-condition from WareWolf-MoonWall's review on #6099.

Duplicates/Related: Follow-up from #6099. Same problem space as #6092 (fallback config resolution).

Actionability: Ready for work — fix shape described (fail-loud + sentinel split).

[perlowja]

Parent PR #6099 merged 2026-04-27 (preserve user-supplied providers.fallback through load/save). The gateway silent-fallback hardening in crates/zeroclaw-gateway/src/lib.rs described here is independent of the parent and remains backlog — flagging for a future patch series.

[perlowja]

FYI: @singlerider's #6215 (fix(gateway,channels): mirror #6099 fail-loud model resolution) applies the same fail-loud model-resolution pattern from #6099 to the gateway and channels surfaces, which substantially overlaps with the silent-fallback hardening this issue tracks.

Will leave this open until #6215 lands so we can verify scope coverage in the gateway code paths called out in the original issue body. May close as superseded once that PR merges, depending on what's left to harden after the mirror lands.