fix(ci/issue-comment): run agent only when OPENAI key exists; gate steps with secrets context; add proxy log tail for debug; avoid noisy stream errors

.github/workflows/issue-comment.yml

@@ -258,7 +258,7 @@ jobs:
             fs.writeFileSync('.github/auto/ISSUE_PREVIEW_CONTEXT.md', lines.join('\n'));
 
       - name: Start local OpenAI proxy (optional; hardened)
-        if: env.OPENAI_API_KEY != ''
+        if: secrets.OPENAI_API_KEY != ''
         id: proxy
         env:
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
@@ -268,9 +268,16 @@ jobs:
           PORT=5056 LOG_DEST=stdout EXIT_ON_5XX=1 RESPONSES_BETA="responses=v1" node scripts/openai-proxy.js > .github/auto/openai-proxy.log 2>&1 &
           for i in {1..30}; do if nc -z 127.0.0.1 5056; then break; else sleep 0.2; fi; done || true
 
+      - name: Print proxy startup log tail
+        if: secrets.OPENAI_API_KEY != ''
+        run: |
+          echo '### openai-proxy.log (tail)' >> "$GITHUB_STEP_SUMMARY"
+          { echo '```'; tail -n 80 .github/auto/openai-proxy.log || true; echo '```'; } >> "$GITHUB_STEP_SUMMARY"
+
 
       - name: Generate comment with Code (read-only)
         id: gen
+        if: secrets.OPENAI_API_KEY != ''
         continue-on-error: true
         env:
           ISSUE_AUTHOR: ${{ steps.meta.outputs.issue_author }}
@@ -320,7 +327,7 @@ jobs:
           true
           set -e
       - name: Assert agent success (fail on streaming/server errors)
-        if: env.OPENAI_API_KEY != ''
+        if: secrets.OPENAI_API_KEY != ''
         run: |
           set -euo pipefail
           if rg -n "^\\[.*\\] ERROR: (stream error|server error|exceeded retry limit)" .github/auto/AGENT_OUT.txt >/dev/null 2>&1; then
@@ -555,7 +562,7 @@ jobs:
           set -e
 
       - name: Extract generated comment
-        if: env.OPENAI_API_KEY != ''
+        if: secrets.OPENAI_API_KEY != ''
         run: |
           set -euo pipefail
           node - <<'JS'
@@ -575,7 +582,7 @@ jobs:
           JS
 
       - name: Post generated comment to issue
-        if: env.OPENAI_API_KEY != ''
+        if: secrets.OPENAI_API_KEY != ''
         uses: actions/github-script@v7
         env:
           ISSUE_NUMBER: ${{ steps.ctx.outputs.issue_number }}