Fail fast with a clear message when the engine endpoint or key is missing

[charlesgreen]

Adopters must supply their own AZURE_OPENAI_ENDPOINT and AZURE_OPENAI_API_KEY; a reusable workflow never inherits the host repository's variables or secrets, so there is no path to the maintainer's instance. That is the correct behaviour and it should stay.

The gap is what happens when an adopter has not set them yet.

Problem

azure-openai-endpoint is declared required: true, but a caller that references an unset repository variable passes an empty string, which satisfies the required check. The job then runs the whole toolchain install and fails deep inside the engine with an unhelpful error, or worse, tries a request against a malformed base URL.

The same applies to the API key secret.

Work

• Validate immediately after checkout, before the toolchain installs: if the endpoint is empty or does not parse as an https URL, or the key is empty, fail with a message that names the missing variable or secret and points at the README's install section.
• Mirror the check in the CLI so a local run reports the same thing (it already errors on unset env vars; align the wording).
• The README and docs/setup.md already list both as adopter-supplied. Add one sentence making explicit that they are per-repository and never inherited from SimplyCubed.

Acceptance

• A repository that installs the App and merges the caller workflow without setting the endpoint or key fails within seconds, naming exactly what is missing.
• No run proceeds to the engine with an empty endpoint.

[simplycubed-code]

Blocked: gate passed but the working tree has no changes to propose