test: align deployment and lease contracts

tests/test_deployment_config.py

@@ -47,7 +47,7 @@ def test_compose_defines_database_control_plane_and_outbound_host_agent() -> Non
     ) & REMOVED_CREDENTIAL_SETTINGS
 
 
-def test_deploy_compose_has_only_cloud_services_and_minimal_environment() -> None:
+def test_deploy_compose_has_only_cloud_services_and_required_environment() -> None:
     compose = yaml.safe_load(
         (ROOT / "compose.deploy.yaml").read_text(encoding="utf-8")
     )
@@ -62,6 +62,7 @@ def test_deploy_compose_has_only_cloud_services_and_minimal_environment() -> Non
             "@postgres:5432/${POSTGRES_DB}"
         ),
         "CLOUD_TRUST_PROXY_HEADERS": "${CLOUD_TRUST_PROXY_HEADERS:-false}",
+        "CLOUD_LLM_PROVIDER_ENCRYPTION_KEY": "${CLOUD_LLM_PROVIDER_ENCRYPTION_KEY}",
     }
 
 
@@ -90,5 +91,7 @@ def test_example_environment_contains_no_static_credentials() -> None:
         "POSTGRES_USER",
         "POSTGRES_PASSWORD",
         "CLOUD_API_PORT",
+        "CLOUD_LLM_PROVIDER_ENCRYPTION_KEY",
     }
     assert not set(values) & REMOVED_CREDENTIAL_SETTINGS
+    assert values["CLOUD_LLM_PROVIDER_ENCRYPTION_KEY"].startswith("change-me-")