Clarify credential inspection and protect request privacy

docs/consumers/pkg-promptkit.md

@@ -719,18 +719,19 @@ if err != nil {
 }
 
 target := inspection.EffectiveModelParams
+if inspection.APIKeyRequired {
+	// Arrange a usable direct or configured environment credential.
+}
 if target.APIKeyEnv != "" {
-	// This is a configured optional environment lookup source.
-} else if inspection.APIKeyRequired {
-	// Arrange a direct credential before later execution.
+	// This is the configured environment lookup source, not its value.
 }
 ```
 
 Use this configuration-time boundary when only the profile and its target need
 checking. Use `Prepare` when the application also needs prompt, input, schema,
 or rendering work; use prepared execution when that work must remain tied to a
-later execution. A reported `APIKeyEnv` is a configured optional source, while
-`APIKeyRequired` is the explicit local requirement. The
+later execution. A reported `APIKeyEnv` identifies a configured source, while
+`APIKeyRequired` is the explicit requirement; both may be present. The
 [credential format reference](../formats.md#credentials) and the method's
 [GoDoc](../../engine.go) own the exact precedence, timing, result, and error
 contracts.