Drop HOTDATA_TOKEN fallback from runtime auth resolution.

Require HOTDATA_API_KEY as the single environment contract so runtime behavior and docs stay unambiguous.

Author: eddietejeda

CONTRACT.md

@@ -60,7 +60,7 @@ Adapters should import from `hotdata_runtime` and treat this surface as the stab
 
 ### Env Resolution
 
-- `default_api_key()` reads `HOTDATA_API_KEY` then `HOTDATA_TOKEN`.
+- `default_api_key()` reads `HOTDATA_API_KEY`.
 - `default_host()` reads `HOTDATA_API_URL` (default: `https://api.hotdata.dev`) and normalizes it.
 - `default_session_id()` reads `HOTDATA_SANDBOX`.
 - `pick_workspace()` prefers explicit env workspace, then active workspace, then first workspace.

hotdata_runtime/client.py

@@ -78,9 +78,7 @@ def __init__(
     def from_env(cls) -> HotdataClient:
         api_key = default_api_key()
         if not api_key:
-            raise RuntimeError(
-                "HOTDATA_API_KEY or HOTDATA_TOKEN must be set."
-            )
+            raise RuntimeError("HOTDATA_API_KEY must be set.")
         host = default_host()
         session = default_session_id()
         workspace_id = pick_workspace(api_key, host, session)

hotdata_runtime/env.py

@@ -19,9 +19,7 @@ def normalize_host(url: str) -> str:
 
 
 def default_api_key() -> str:
-    return os.environ.get("HOTDATA_API_KEY", "") or os.environ.get(
-        "HOTDATA_TOKEN", ""
-    )
+    return os.environ.get("HOTDATA_API_KEY", "")
 
 
 def explicit_workspace_id() -> str | None: