- node.py: mark get_api_key as @staticmethod since it doesn't use self
- node.py: clarify the IS_CHANGED comment about why env/file keys are
intentionally excluded from the cache key
- README: warn users to clear the api_key field if they ever typed it in
(since the value persists in the workflow JSON), and add a chmod 600
hint for the JSON config on Linux/macOS
No behavior changes.
Gabe