[Sunrisea]

Imported FunctionCall tools retain a bound credentialName in the control plane, but the Python SDK never resolves it when calling the external API. An API requiring X-API-Key therefore receives no credential unless callers embed the secret in the OpenAPI spec or pass headers themselves.

This change declares Tool.credential_name and resolves bound API key credentials on each FUNCTIONCALL / OPENAPI_IMPORT invocation, using the effective request configuration. It injects headerKey (default X-API-Key) with the exact prefix + secret value, including an empty prefix, and merges header names case-insensitively. Lookup failures, empty secrets, and unsupported credential types stop the request. Existing fixed-header precedence, unbound tools, and code-package invocation behavior are preserved. The sync implementation is regenerated from the async template.

Validation:

• Added 30 sync/async regression cases covering request headers, rotation, configuration preservation, request-scoped STS, fixed-header precedence, compatible paths, and credential failures. Confirmed the injection tests fail before the fix.
• Tool, credential, and STS regression suites: 362 passed.
• New executable lines: 28/28 covered. Local HTTP server smoke passed for sync and async requests.
• uv run --no-sync mypy --config-file mypy.ini .: no issues in 376 source files. Changed files pass Pyink and whitespace checks.
• Full unit suite rerun after installing google-adk 2.12.0, langchain 1.4.6, and ag-ui-protocol 1.0.0 in the existing virtual environment: branch 3528 passed, 55 failed, 70 errors, 8 skipped; unmodified origin/main in the same environment 3498 passed, 55 failed, 70 errors, 8 skipped. All 125 failing/error node IDs match exactly; no new failures. Remaining failures include missing optional integrations (Playwright, AgentScope, CrewAI, LangChain providers, Pydantic AI) and existing integration/API expectation mismatches. Full-suite coverage is 88.92% statements / 81.40% branches; the test suite is not claimed green. The related 362 tests and mypy still pass after dependency installation. Dependency manifests and lockfiles are unchanged.