Add warnIfUnclaimed() module that shows a non-blocking stderr warning
when management commands run against an unclaimed environment. Lazily
checks claimed status via createClaimNonce() once per session and
auto-upgrades config when claimed. Wired into all management command
handlers in bin.ts. Updated env list to show (unclaimed) label.

…ork call from warning

- unclaimed-env-api: treat HTTP 409 as alreadyClaimed (not generic error)
- claim command: detect 401 in polling loop, clean up and exit
- unclaimed-warning: re-add lazy claim check to detect external claims,
  handle 401 by removing stale claim token

Start a lightweight proxy that injects x-workos-claim-token and
x-workos-client-id headers when the active environment is unclaimed.
This allows the installer's AI agent to authenticate with the LLM
gateway without OAuth tokens.

…in instead of re-provisioning

Subcommands: state (dump raw credentials/config/storage), reset (clear
auth state), simulate (write real state for edge-case testing), token
(decode JWT claims). Hidden from --help, supports --json output mode.

…effects

…ddleware

- Extract HOP_BY_HOP_HEADERS, filterHeaders(), buildUpstreamPath() in
  credential-proxy.ts — eliminates duplicate header/URL logic between
  startCredentialProxy and startClaimTokenProxy
- Replace 82 individual maybeWarnUnclaimed() calls in bin.ts with a
  single yargs middleware (excludes auth/claim/install/debug/env/skills/doctor)
- Add change-detection guard in markEnvironmentClaimed() to skip
  redundant filesystem writes on already-claimed environments

- saveConfig() now verifies keyring writes with immediate read-back,
  falling back to file if the keyring entry isn't readable
- Provisioning verifies config persisted after save
- debug state shows separate Storage sections for credentials and config,
  each with their own keyring/file diagnostics
- markEnvironmentClaimed() renames env key from 'unclaimed' to 'sandbox'
- Claim success now prompts user to run `workos auth login`

- Track consecutive poll failures in claim command and update spinner
  message after 3+ failures to surface connection issues to user
- Fix credential-proxy module comment ("from file" -> "into upstream
  requests") and soften claim token expiry assumption
- Remove vestigial comment in debug.ts that described old approach
- Extract MockUnclaimedEnvApiError to shared test helper to deduplicate
  identical classes in claim.spec.ts and unclaimed-warning.spec.ts
- Extract resolveInstallCredentials from bin.ts to standalone module
  with 10 unit tests covering the full credential resolution priority
  chain (env var > flag > unclaimed > OAuth > provision > login)

- Reorder .env.local write before config save to prevent orphaned config
  entries on filesystem failure
- Add MAX_CONSECUTIVE_FAILURES (10) cap to claim polling loop for early
  exit instead of burning full 5-minute timeout
- Prevent markEnvironmentClaimed from overwriting existing sandbox env
- Add logging for non-401 errors in warnIfUnclaimed claim check
- Log browser open errors in claim command for diagnostics
- Wrap resolveInstallCredentials in try-catch with contextual logging
- Replace || with ?? for camelCase/snake_case API field resolution
- Add dashboard and default command to middleware exclusion list
- Correct RFC citation (2616 → 7230 §6.1) for hop-by-hop headers
- Add 9 tests: 401 poll auto-claim, 401 warning promotion, 409 conflict,
  consecutive failure cap, spinner message, browser open failure, config
  read-back failure, non-unclaimed no-op, sandbox key collision
- Fix exitWithError mock to throw (matches debug.spec.ts pattern)
- Add message method to spinner mock