Fit the plugin lane's LiteLLM config to the plugin's main

Found on a plugin-lane rig: the lane's LiteLLM config no longer fit the plugin, and LiteLLM answered every AI Gateway call with a 400. It still registered the old plugin_litellm callback, where the plugin's main (c7dcf8a) registers four litellm_gitlab_* callbacks and refuses the user header from any key not listed in USER_HEADER_TRUSTED_KEYS.

litellm_config.sim.yaml now lists the four callbacks, and up.sh adds USER_HEADER_TRUSTED_KEYS=master-key to the VM's .env if it is absent, since the gateway calls with the master key. The plugin sits in a private project that drift-check cannot read anonymously, so plugin up runs a new plugin-preflight.sh against the tree it is given and refuses a mismatch in callbacks, user header or the trusted-keys line before it ships anything.

The lane installs whichever checkout the operator names and pins no ref, so the preflight is what catches the next drift; just ci passes.