fix(agents-login): capture a full user:profile-scoped Claude credential

[ExtraToast]

Problem

Runner Claude sessions showed "Claude API" instead of the Claude subscription. The worker captured a claude setup-token token, which is inferenceOnly — scoped user:inference only, no user:profile. Claude Code resolves its subscription/header label from the OAuth account profile (oauthAccount), which needs user:profile; without it, it falls back to "Claude API". (Live runner confirmed: /api/oauth/profile → permission_error … any_of(user:profile, user:office).)

Change

Switch Claude capture from setup-token to the interactive "Claude account with subscription" (claudeai) login, which mints the full-scope credential (user:profile + user:inference + refresh) and writes both ~/.claude/.credentials.json and ~/.claude.json (oauthAccount):

• Launch bare claude; seed onboarding flags in ~/.claude.json (only when absent) and write a managed-settings.json with forceLoginMethod=claudeai via CLAUDE_CODE_MANAGED_SETTINGS_PATH so the subscription method is pre-selected.
• Bounded Enter-through navigation past the theme/intro screens until the authorize URL appears (reuses the existing authorize-URL parse + code-paste machinery — UI flow unchanged).
• Capture the verbatim credentials_json + extracted oauthAccount (account_json); post both to agents-api (oauth_token kept optional for back-compat). Completion now keys off the credentials file, not a stdout token.

Validated live that the claudeai authorize URL carries …user:profile user:inference user:sessions:claude_code…. Pairs with the agents-repo change (ExtraToast/agents#121) that injects credentials_json + account_json into runners.

Tests

vitest run: 10 files / 94 tests pass; tsc --noEmit clean.

Note: the real-claude TUI flow still needs one validation pass in the worker container (Enter-through reaching the URL, code completion, resulting .credentials.json carrying user:profile + subscriptionType).

🤖 Generated with Claude Code