fix(rapidapi): add cron credential diagnostics

Squash merge PR #101 after resolving dev conflicts and fixing cron GetJob snapshot race. PR CI run 26703877225 passed release-versioning, go, and web.

docs/project-changelog.md

@@ -6,6 +6,22 @@ Significant changes, features, and fixes in reverse chronological order.
 
 ## 2026-05-29
 
+### RapidAPI cron SecureCLI diagnostics (issue #74)
+
+**Fixes**
+
+- Added a built-in `rapidapi` SecureCLI preset with required `RAPIDAPI_KEY`, 60s timeout, and verbose/debug flag denials.
+- Credentialed exec now validates required preset env keys before binary resolution, so missing RapidAPI credentials return a GoClaw diagnostic instead of downstream `RAPIDAPI_KEY required`.
+- Added safe SecureCLI env diagnostics that log env key names/count context only, never credential values.
+- Added `RAPIDAPI_KEY` to fall-through exec env scrubbing.
+
+**Tests**
+
+- Added RapidAPI preset contract and deny-pattern coverage.
+- Added credentialed exec regressions for missing RapidAPI env and successful direct exec with injected `RAPIDAPI_KEY`.
+
+---
+
 ### Sandbox tenant workspace isolation (issue #68)
 
 **Security**