Fix profile loading with ConfigKit history

internal/config/pipeline_configkit_test.go

@@ -88,6 +88,35 @@ whisperx:
 	}
 }
 
+func TestPipelineProfileDoesNotRequireUnusedBaseCredentials(t *testing.T) {
+	const production = "NARRATIO_PROFILE_UNUSED_PROD_KEY"
+	const testingKey = "NARRATIO_PROFILE_TEST_KEY"
+	t.Setenv(production, "")
+	if err := os.Unsetenv(production); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv(testingKey, "synthetic-test-key")
+	for _, credential := range []string{testingKey, "null"} {
+		t.Run(credential, func(t *testing.T) {
+			dir := t.TempDir()
+			root := writePipelineFixture(t, dir, "pipeline.yml", "whisperx:\n  transcribe_url: https://transcription.example.test/transcribe\naudita:\n  llm_api_key: "+production+"\n")
+			writePipelineFixture(t, dir, "profiles/testing.yml", "audita:\n  llm_api_key: "+credential+"\n")
+			profile := "testing"
+			cfg, err := LoadPipelineWithOptions(root, PipelineLoadOptions{Profile: &profile})
+			if err != nil {
+				t.Fatal(err)
+			}
+			if credential == "null" {
+				if cfg.Audita.LLMAPIKey != nil {
+					t.Fatal("profile did not remove the base credential")
+				}
+			} else if cfg.Audita.LLMAPIKey == nil || cfg.Audita.LLMAPIKey.EnvName() != testingKey || !cfg.Audita.LLMAPIKey.IsResolved() {
+				t.Fatal("profile credential was not resolved")
+			}
+		})
+	}
+}
+
 func TestPipelineConfigKitAllowsOneBaseDeclarationWithProfileOverride(t *testing.T) {
 	dir := t.TempDir()
 	writePipelineFixture(t, dir, "pipeline.yml", `configkit: