Verify Fireworks API key once for CLI flows

[benjibc]

Motivation

• Prevent mid-run FIREWORKS API key changes from breaking long CLI flows by reusing a single resolved API key for account verification.
• Make secret upload and RFT creation use the same initial key so account ID resolution is consistent across steps.

Description

• Allow _ensure_account_id to accept an optional api_key parameter and prefer an explicitly provided key over re-reading the environment by changing def _ensure_account_id(api_key: Optional[str] = None) -> Optional[str] in eval_protocol/cli_commands/utils.py.
• Pass the resolved api_key into _ensure_account_id from create_rft_command by calling _ensure_account_id(api_key=api_key) in eval_protocol/cli_commands/create_rft.py.
• Resolve and reuse the initial FIREWORKS_API_KEY in upload_command and pass it into _ensure_account_id and create_or_update_fireworks_secret in eval_protocol/cli_commands/upload.py so secret registration uses the same key.

Testing

• Attempted to run pre-commit run --all-files, but the check failed because pre-commit was not installed in the environment.
• No other automated test runs were executed as part of this change.

---

Codex Task

---

Note

Ensures CLI flows consistently use a single resolved API key, avoiding mid-run environment drift.

• Update utils._ensure_account_id(api_key) to accept an optional api_key and prefer it over re-reading the environment
• In create_rft.py, pass the resolved api_key into _ensure_account_id
• In upload.py, resolve FIREWORKS_API_KEY once and pass it to _ensure_account_id and create_or_update_fireworks_secret so secret registration uses the same key

^{Written by Cursor Bugbot for commit f93bd40. This will update automatically on new commits. Configure here.}