Rush CLI 0.2.45

rush provider (local BYOK provider credentials) is gone (PHNX-3946). The provider add/list/remove/test commands and the provider priority / provider alias subgroups were deleted — implementations, not just registrations. Their only consumer was the local agent runtime's LLM client (ResolveBYOKForModel, wired into initializeLLMRouterWithVerbose); the keys never reached a cloud dispatch, and local execution is being retired. The one credential concept a user manages now is their cloud account (rush cloud accounts), which registers Claude/Codex credentials with Rush Cloud for server-side dispatch. Keychain entries byok_<provider>_key / _endpoint / byok_priority / byok_aliases are no longer read or written; they are inert and can be removed with security delete-generic-password -s rush -a byok_openai_key (etc.) if desired.

Local rush serve no longer applies BYOK provider routing (PHNX-3946). The BYOK resolver was removed from initializeLLMRouterWithVerbose, which serve.go:108 also calls, so a local rush serve now uses the platform route instead of your own provider keys. Inert for pod-hosted serve — a pod has no local OS keychain to read — but it is a real change for anyone running rush serve on their own machine.

The local rush sessions AGENT_PATH reader is gone (PHNX-3946). It walked the on-disk session store for locally-executed agents; the product runs in the cloud. sessions.go and sessions_picker.go are deleted — implementations, not just registrations. loadSessionArtifacts (artifacts.go) keeps the internal-log-exclusion guarantee that collectArtifacts used to assert, so that coverage moved rather than being dropped.