feat(copilot-sdk): support BYOK (Bring Your Own Key)

[christso]

Summary

• Add optional byok block to copilot-sdk target config, allowing users to route requests through their own Azure OpenAI, OpenAI, or Anthropic endpoints instead of GitHub's Copilot infrastructure
• Pass the SDK's provider option to createSession() when BYOK fields are present
• Auto-normalize bare Azure resource names to full URLs (e.g. my-resource → https://my-resource.openai.azure.com)
• Secrets (api_key, bearer_token) require ${{ ENV_VAR }} syntax — no plaintext literals allowed

Example config

- name: copilot-sdk-azure
  provider: copilot-sdk
  model: ${{ AZURE_DEPLOYMENT_NAME }}
  byok:
    type: azure
    base_url: ${{ AZURE_OPENAI_ENDPOINT }}
    api_key: ${{ AZURE_OPENAI_API_KEY }}
  grader_target: grader

Changes

• packages/core/src/evaluation/providers/types.ts — add byok field to TargetDefinition
• packages/core/src/evaluation/providers/targets.ts — add BYOK fields to CopilotSdkResolvedConfig, parse byok block in resolveCopilotSdkConfig()
• packages/core/src/evaluation/providers/copilot-sdk.ts — build and pass provider block to createSession(), normalize bare Azure resource names
• packages/core/src/evaluation/validation/targets-validator.ts — add byok to known copilot-sdk settings
• .agentv/targets.yaml — add copilot-sdk-azure target using AZURE_OPENAI_ENDPOINT
• Tests for config resolution (9 cases) and provider behavior (8 cases)

Test plan

• Unit tests pass for config resolution (azure, openai, bearer token, wire_api, missing base_url, literal api_key/bearer_token rejection, no-byok baseline)
• Unit tests pass for provider session options (azure provider block, bearer token, wireApi, no-provider baseline, default type, non-azure skips azure block, bare resource name normalization, full URL passthrough)
• Build, typecheck, lint all pass
• Red/green UAT with a real Azure OpenAI endpoint

Closes #955

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying agentv with    Cloudflare Pages

Latest commit:	07b3712
Status:	⚡️  Build in progress...

View logs

[christso]

Red/Green UAT Evidence

RED (on main) — BYOK fields silently ignored

=== Test 1: Config resolution ===
kind: copilot-sdk
model: gpt-5.4-mini
byokType: undefined
byokBaseUrl: undefined
byokApiKey: undefined
byokApiVersion: undefined
FAIL: BYOK fields not resolved

Config resolution on main shows the byok block is silently ignored — all BYOK fields resolve to undefined.

GREEN (on feat/955-copilot-sdk-byok) — BYOK fields resolved and routed through Azure

Config resolution:

=== Test 1: Config resolution ===
kind: copilot-sdk
model: gpt-5.4-mini
byokType: azure
byokBaseUrl: ***set***
byokApiKey: ***set***
byokApiVersion: 2024-10-21
PASS: BYOK fields resolved correctly

=== Test 2: Backward compatibility (no byok) ===
PASS: No BYOK fields present (backward compatible)

=== All UAT tests passed ===

Full e2e eval through Copilot SDK → Azure OpenAI:

Using target: copilot-sdk-azure
1/1   ✅ hello-byok | copilot-sdk-azure | 1.000 PASS

RESULT: PASS  (1/1 scored >= 0.8, mean: 1.000)

The eval ran successfully with the Copilot SDK routing through Azure OpenAI via BYOK, scoring 1.000.