Add team billing headers to JudgeRubric default client

[shayonj]

Judge clients were missing the X-Prime-Team-ID header when created without an explicit AsyncOpenAI instance — this caused judge API calls (e.g., to api.pinference.ai) to bill the user's personal account instead of the team, even when PRIME_TEAM_ID was set in the environment.

Generation clients already handle this correctly via _build_headers_and_api_key in client_utils.py — this PR extracts that logic into a reusable build_prime_headers() helper and wires it into JudgeRubric's default client.

Note

Environments that create their own judge AsyncOpenAI clients directly still need to pass the header themselves, this PR only fixes the default path in JudgeRubric. Those environments could switch to passing no judge_client and letting the default handle it, or use build_prime_headers() directly.

---

Note

Medium Risk
Changes how JudgeRubric constructs its default AsyncOpenAI client by injecting Prime API key resolution and X-Prime-Team-ID headers, which can affect request routing/billing and potentially authentication if misconfigured.

Overview
Fixes missing Prime team billing context for judge calls by extracting Prime API key/header resolution into reusable build_prime_headers() and reusing it across clients.

When JudgeRubric creates its own default AsyncOpenAI client (no explicit judge_client provided), it now sets default_headers to include X-Prime-Team-ID (from PRIME_TEAM_ID or ~/.prime/config.json) and resolves PRIME_API_KEY consistently. Adds tests covering build_prime_headers() behavior and verifying JudgeRubric header propagation and non-overriding of explicitly provided clients.

^{Written by Cursor Bugbot for commit cd4eae9. This will update automatically on new commits. Configure here.}