[Kayvan Zahiri (Kayvan-Zahiri)]

With credentials supplied through default_headers or per-request extra_headers, the SDK rejects valid lowercase authorization and mixed-case X-API-Key headers before sending the request. HTTP header names are case-insensitive, but both generated _validate_headers methods look up dictionary keys with fixed casing.

Normalize names locally before checking credentials and explicit omission in the sync and async clients. Missing credentials still fail locally. This change does not alter outgoing header merging or wire spelling.

Adds 34 offline public machines.list() cases across both clients: three casings of each supported credential header, default/per-request headers, explicit omission, and missing-auth rejection. HTTPX MockTransport checks the requests without calling a deployment.

Validation: 20 new cases fail and 14 controls pass before the fix; all 36 discovered offline tests pass afterward, including the two existing retry tests. The live smoke-test.py script was not run. New-test Ruff lint, source blocking lint, and git diff --check pass. The CI-pinned Ruff 0.16.8 formatter accepts all 86 files; wheel and source-distribution builds pass. Broader client lint and mypy retain 10 and 4 findings respectively, reproduced with the original client source.

This is generated Scalar code. Please carry the case-insensitive lookup into the authentication-validation generator/template so regeneration preserves the fix; this draft demonstrates the change and provides regressions.