feat(quickstart): run CLI subscription auth inline

[JordanTheJet]

Summary

• Base branch: master (all contributions)
• What changed and why:
  • Runs the CLI Quickstart auth follow-up when the user selected the shared auth_mode added in feat(quickstart): add subscription auth modes #13.
  • For OpenAI Codex, offers to import ~/.codex/auth.json when present or starts the existing zeroclaw auth login --model-provider openai-codex browser flow.
  • For Anthropic setup_token, runs claude setup-token, prompts for the generated token, and persists it to the canonical providers.models.anthropic.<alias>.api_key path.
  • Keeps the flow skippable and prints the exact manual finish command if auth is declined or fails.
• Scope boundary: This PR only adds inline auth to the CLI Quickstart. Web still needs a gateway-mediated OAuth/setup-token flow; TUI and web keep the shared selection/config behavior from feat(quickstart): add subscription auth modes #13.
• Blast radius: CLI Quickstart provider field flow, CLI auth prompting, OpenAI Codex auth import/login, and Anthropic setup-token persistence.
• Linked issue(s): Depends on feat(quickstart): add subscription auth modes #13.
• Labels: enhancement, provider, provider:openai, runtime, core, config, docs, quickstart

Validation Evidence (required)

Local validation is the signal CI cannot replace. Run the full battery and paste literal output (tails, failures, warnings — not "all passed").

cargo fmt --all -- --check
cargo clippy --all-targets -- -D warnings
cargo test

Docs-only changes: replace with markdown lint + link-integrity (scripts/ci/docs_quality_gate.sh). Bootstrap scripts: add bash -n install.sh.

• Commands run and tail output:

cargo fmt --all -- --check

(no output; command exited 0)

cargo clippy --all-targets -- -D warnings

    Checking zeroclawlabs v0.8.2
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 4.05s

cargo test

running 9 tests
test system::multi_agent_e2e::peer_group_routes_messages_only_within_resolved_peer_set ... ok
test system::multi_agent_e2e::peer_group_dotted_channel_refs_remain_alias_scoped_for_dispatch ... ok
test system::multi_agent_e2e::legacy_install_upgrades_cleanly_with_backup ... ok
test system::full_stack::system_tool_execution_flow ... ok
test system::full_stack::system_tool_arguments_passed_correctly ... ok
test system::full_stack::system_simple_text_response ... ok
test system::full_stack::system_multi_turn_conversation ... ok
test system::full_stack::system_parallel_tool_execution ... ok
test system::multi_agent_e2e::two_sqlite_agents_on_one_install_have_isolated_memory ... ok

test result: ok. 9 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.06s

   Doc-tests zeroclaw

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

Additional focused checks run before the full battery:

cargo test -p zeroclawlabs tests::quickstart_inline_auth_uses_auth_mode_field
# 1 passed; 0 failed

cargo test -p zeroclaw-runtime quickstart::tests
# 22 passed; 0 failed

• Beyond CI — what did you manually verify? Static review of the stacked diff confirms PR 2 only changes src/main.rs and crates/zeroclaw-runtime/locales/en/cli.ftl on top of feat(quickstart): add subscription auth modes #13. I did not run an interactive Codex browser login or claude setup-token locally.
• If any command was intentionally skipped, why: Interactive live auth was not run because it requires user accounts and real credential flows.

Security & Privacy Impact (required)

Yes/No for each. Answer any Yes with a 1–2 sentence explanation.

• New permissions, capabilities, or file system access scope? (Yes)
• New external network calls? (Yes)
• Secrets / tokens / credentials handling changed? (Yes)
• PII, real identities, or personal data in diff, tests, fixtures, or docs? (No)
• If any Yes, describe the risk and mitigation: CLI Quickstart can now invoke existing auth flows after successful config apply. Codex uses the existing ZeroClaw auth profile store; Anthropic setup-token writes only to the existing canonical provider api_key config field, and the token prompt uses the existing password input path.

Compatibility (required)

• Backward compatible? (Yes)
• Config / env / CLI surface changed? (Yes)
• If No or Yes to either: Existing configs and non-subscription Quickstart paths are unchanged. Users who pick Codex or Anthropic setup-token in CLI Quickstart now get an optional inline auth prompt after apply; declining prints the manual finish command.

Rollback (required for medium/high-risk PRs)

Low-risk PRs: git revert <sha> is the plan unless otherwise noted.

Medium/high-risk PRs must fill:

• Fast rollback command/path: git revert 4d0917b31
• Feature flags or config toggles: None.
• Observable failure symptoms: CLI Quickstart hangs or errors during post-create auth, Codex auth import/login fails after create, or Anthropic setup-token fails to persist providers.models.anthropic.<alias>.api_key.

Supersede Attribution (required only when Supersedes # is used)

• Superseded PRs + authors (#<pr> by @<author>, one per line): N/A
• Scope materially carried forward: N/A
• Co-authored-by trailers added in commit messages for incorporated contributors? (No)
• If No, why (inspiration-only, no direct code/design carry-over): N/A