Function validate_provider_env 

pub fn validate_provider_env(
    cfg: &RepoProviderConfig,
    resolved: &BTreeMap<String, String>,
) -> Result<(), String>

Check that a resolved env satisfies the selected provider’s API-key requirement, returning an actionable message when it does not.

This complements resolve_env, which only warn!s on a dangling api_key_from_env reference and then proceeds. Validating the resolved map (rather than the raw config) means a key supplied through any layer — curated api_key_from_env, raw cfg.env, or the global default_env — counts, so there are no false positives. Providers without a key var (ollama, bedrock, vertex) and an unset provider always pass.