[Sunrisea]

Imported FunctionCall tools retain a bound credentialName in the control plane, but the Python SDK never resolves it when calling the external API. An API requiring X-API-Key therefore receives no credential unless callers embed the secret in the OpenAPI spec or pass headers themselves.

This change declares Tool.credential_name and resolves bound API key credentials on each FUNCTIONCALL / OPENAPI_IMPORT invocation, using the effective request configuration. It injects headerKey (default X-API-Key) with the exact prefix + secret value, including an empty prefix, and merges header names case-insensitively. Lookup failures, empty secrets, and unsupported credential types stop the request. Existing fixed-header precedence, unbound tools, and code-package invocation behavior are preserved. The sync implementation is regenerated from the async template.

Validation:

• Added 30 sync/async regression cases covering request headers, rotation, configuration preservation, request-scoped STS, fixed-header precedence, compatible paths, and credential failures. Confirmed the injection tests fail before the fix.
• Tool, credential, and STS regression suites: 362 passed.
• New executable lines: 28/28 covered. Local HTTP server smoke passed for sync and async requests.
• uv run --no-sync mypy --config-file mypy.ini .: no issues in 376 source files. Changed files pass Pyink and whitespace checks.
• Full unit suite was attempted with --continue-on-collection-errors: branch 3288 passed, 183 failed, 95 errors, 10 skipped; unmodified origin/main in the same environment 3258 passed, 183 failed, 95 errors, 10 skipped. The 278 failing/error node IDs match exactly. The local environment lacks optional integrations including Google ADK, LangChain, AG-UI, and Playwright; the full suite is not claimed green.