A focused fix for anyone who brings their own API keys into the desktop app. A key you pasted was being saved under one name while the request path looked it up under another, so a freshly added key was quietly ignored — your requests kept using the old one and came back unauthorized — and deleting a key could leave a second, hidden copy behind that made it seem to come back. Keys now save under a single canonical name, deletes remove every copy, and installs that were already in this state heal themselves the first time the key is read, with nothing to re-enter.

• Desktop keys are saved, read, and deleted under one name. API keys added in the desktop app were stored under a different spelling than the one requests read, so a new key was ignored — you'd get stale-key 401s — and deleting a key could leave a hidden copy that made it reappear. The desktop app now stores and removes keys under the same canonical name every other surface already uses: new keys take effect immediately, deletes purge every copy, and there are no leftover spellings hiding in your keychain.
• Existing broken keys heal on their own. If a key was already saved the old way, the secrets layer recognizes the old spelling, uses it, and collapses it into the canonical name the first time it's read. Affected installs recover on next use — you don't have to re-paste anything.

• Every macOS and Linux build is still executed before it ships — empryo doctor must load the native runtime and parse real code inside a Linux container, and under Rosetta for Intel macOS.