fix: add env sanitization, OpenRouter transforms routing, and web search prohibition

[82deutschmark]

This PR adds three resilience improvements:

1. Environment variable sanitization - Fixes 401 errors caused by API keys wrapped in quotes (common on Windows/PowerShell)
2. OpenRouter transforms routing - Routes the 'middle-out' context compression transform through 'extra_body' to avoid OpenAI SDK validation errors
3. Web search prohibition - Adds explicit instruction to prevent models from performing web searches during gameplay, ensuring the benchmark measures pure reasoning

These are battle-tested fixes from production use.

[82deutschmark]

I wondered why my costs to test this new GLM 4.7 model were so high. And then I realized it was doing web searches to figure out how to play Snake and what a good strategy would be.