feat: add zero-auth install flow with claim command

.gitignore

@@ -36,3 +36,6 @@ tests/eval-results/
 
 # Local ideation artifacts
 docs/
+
+# Case harness markers
+.case-*

README.md

@@ -50,6 +50,7 @@ workos [command]
 
 Commands:
   install                Install WorkOS AuthKit into your project
+  claim                  Claim an unclaimed environment (link to your account)
   auth                   Manage authentication (login, logout, status)
   env                    Manage environment configurations
   doctor                 Diagnose WorkOS integration issues
@@ -85,6 +86,24 @@ Workflows:
 
 All management commands support `--json` for structured output (auto-enabled in non-TTY) and `--api-key` to override the active environment's key.
 
+### Unclaimed Environments
+
+When you run `workos install` without credentials, the CLI automatically provisions a temporary WorkOS environment — no account needed. This lets you try AuthKit immediately.
+
+```bash
+# Install with zero setup — environment provisioned automatically
+workos install
+
+# Check your environment
+workos env list
+# Shows: unclaimed (unclaimed) ← active
+
+# Claim the environment to link it to your WorkOS account
+workos claim
+```
+
+Management commands work on unclaimed environments with a warning reminding you to claim.
+
 ### Workflows
 
 The compound workflow commands compose multiple API calls into common operations. These are the highest-value commands for both developers and AI agents.
@@ -483,7 +502,7 @@ OAuth credentials are stored in the system keychain (with `~/.workos/credentials
 ## How It Works
 
 1. **Detects** your framework and project structure
-2. **Prompts** for WorkOS credentials (API key masked)
+2. **Resolves credentials** — uses existing config, or auto-provisions an unclaimed environment if none found
 3. **Auto-configures** WorkOS dashboard (redirect URI, CORS, homepage URL)
 4. **Fetches** latest SDK documentation from workos.com
 5. **Uses AI** (Claude) to generate integration code