fix: pos ai — honor legacy AI_API_KEY as fallback (provider key stays primary)

Architect decision C on the API-key contract mismatch: docs claimed
AI_API_KEY was the required primary key, but resolve_key() only read
provider-specific keys (7ae2e77 removed shared-key priority to fix
cross-provider leakage; docs never updated).

- bin/pos-ai resolve_key(): provider key wins, legacy AI_API_KEY honored
  read-only when the provider's own key is empty, llamacpp unchanged;
  cmd_providers() configured check mirrors the same set
- require_key() error messages byte-stable (test-locked)
- AI_API_KEY NOT re-added to the # POS_CONFIG:/# PROVIDER_CONFIG: registry
- Docs reworded: POS.md rows 91/96/98 + precedence sentence, howto/ai.md
  first-run hints, HOWTO.md row, AGENT_Context prose (2 spots), config/ai.env
  legacy comment
- New regression tests/t-ai-key-resolution.sh: 24 checks / 10 cases
  (provider-key-only, AI_API_KEY-only, both -> provider wins, env-wins,
  llamacpp no-key, missing-key message, providers configured status)

Verified: suite 19 files / 440 checks / 0 fail / 0 skip; make gen
byte-idempotent; make check OK; make lint 0 FAIL, 0 WARN; bash -n clean;
git diff --check clean; Reviewer APPROVE_WITH_NOTES (mutation disproof:
inverted precedence -> C3/C6 fail)

DOC/howto/ai.md

@@ -69,7 +69,7 @@ exactly as before (no added blank lines), so scripting stays byte-stable.
 2. Configure it (masked input):
 
    ```bash
-   pos config ai          # enter AI_API_KEY (or AI_GEMINI_API_KEY)
+   pos config ai          # enter AI_GEMINI_API_KEY
    ```
 
 3. Test:
@@ -81,7 +81,10 @@ exactly as before (no added blank lines), so scripting stays byte-stable.
    ```
 
 `ai.env` lives at `~/.config/linux_post_install/ai.env` (chmod 600); `pos config ai`
-is the only place the key is written. The key is never printed by `pos`.
+is where the provider keys are written, and keys are never printed by `pos`. The
+legacy shared `AI_API_KEY` is still honored as a fallback when the provider's own
+key is unset — set it via the shell environment or by hand-editing `ai.env` (it is
+not part of the `pos config ai` prompt).
 
 ## OpenRouter — many providers, one key
 
@@ -98,7 +101,7 @@ pos ai openrouter ask "hi"
 Configure the API key:
 
 ```bash
-pos config ai              # enter AI_API_KEY (or OPENROUTER_API_KEY)
+pos config ai              # enter OPENROUTER_API_KEY
 ```
 
 The default model is `openrouter/auto` (OpenRouter picks the best available