fix(tenki): forward networking/metadata through provision + honor TENKI_AUTH_TOKEN

- managed_local.provision_compute() now forwards `networking` and `metadata`
  into ComputeConfig. Without this they were dropped, so Tenki's allow_outbound
  / tenki_image (the first provider to read them) always saw defaults regardless
  of the caller's request. (Greptile: 'networking policy is dropped')
- TenkiCompute credential resolution now matches the SDK's precedence
  (auth_token -> TENKI_AUTH_TOKEN -> TENKI_API_KEY), so is_available agrees with
  what Client() resolves; docstring + is_available test updated. (CodeRabbit)

src/praisonai-agents/tests/managed/test_cloud_compute.py

@@ -139,12 +139,15 @@ class TestTenkiComputeUnit:
     def test_is_available_without_key(self):
         from praisonai.integrations.compute.tenki import TenkiCompute
         old = os.environ.pop("TENKI_API_KEY", None)
+        old_tok = os.environ.pop("TENKI_AUTH_TOKEN", None)
         try:
             compute = TenkiCompute(api_key="")
             assert compute.is_available is False
         finally:
             if old:
                 os.environ["TENKI_API_KEY"] = old
+            if old_tok:
+                os.environ["TENKI_AUTH_TOKEN"] = old_tok
 
     def test_protocol_methods_exist(self):
         from praisonai.integrations.compute.tenki import TenkiCompute

src/praisonai/praisonai/integrations/compute/tenki.py

@@ -4,7 +4,7 @@ Tenki Compute Provider — cloud sandbox-based compute for managed agents.
 Uses the Tenki Cloud SDK to run tools in disposable Linux microVMs.
 
 Requires: ``pip install tenki``
-Environment: ``TENKI_API_KEY`` (optionally ``TENKI_WORKSPACE_ID``)
+Environment: ``TENKI_API_KEY`` or ``TENKI_AUTH_TOKEN`` (optionally ``TENKI_WORKSPACE_ID``)
 """
 
 import base64
@@ -45,7 +45,13 @@ class TenkiCompute:
         api_key: str = "",
         workspace_id: str = "",
     ) -> None:
-        self._api_key = api_key or os.environ.get("TENKI_API_KEY", "")
+        # Match the SDK's own precedence: explicit key, then TENKI_AUTH_TOKEN,
+        # then TENKI_API_KEY — so is_available agrees with what Client() resolves.
+        self._api_key = (
+            api_key
+            or os.environ.get("TENKI_AUTH_TOKEN", "")
+            or os.environ.get("TENKI_API_KEY", "")
+        )
         self._workspace_id = workspace_id or os.environ.get("TENKI_WORKSPACE_ID", "")
         self._client = None
         self._sandboxes: Dict[str, Dict[str, Any]] = {}

src/praisonai/praisonai/integrations/managed_local.py

@@ -1086,6 +1086,11 @@ class LocalManagedAgent:
             env=kwargs.get("env", self._cfg.get("env", {})),
             packages=kwargs.get("packages", self._cfg.get("packages")),
             working_dir=kwargs.get("working_dir", self._cfg.get("working_dir", "/workspace")),
+            # Forward the networking policy and provider metadata so providers
+            # that honour them (e.g. Tenki's allow_outbound / tenki_image) see
+            # the caller's request instead of always getting the defaults.
+            networking=kwargs.get("networking", self._cfg.get("networking", {"type": "unrestricted"})),
+            metadata=kwargs.get("metadata", self._cfg.get("metadata", {})),
             auto_shutdown=kwargs.get("auto_shutdown", True),
             idle_timeout_s=kwargs.get("idle_timeout_s", 300),
         )