fix: gate CLI background usage fetch on confirmed-absent OAuth creds

[axisrow]

Summary

• Add directCredentialIsMissingOverride TaskLocal to ClaudeOAuthFetchStrategy for deterministic test overrides
• Thread an oauthCredentialsConfirmedAbsent check into ClaudeCLIBackgroundAvailability.allowsBackgroundAutoUsageFetch so the CLI background fallback only fires when direct OAuth credentials are confirmed absent
• Update related characterization/compatibility tests to cover the new gating behavior

Test plan

• swift test

🤖 Generated with Claude Code

[axisrow]

🔍 Local review (cycle 3/3, final) — round a4f67011-f2ea-4bdb-a3c3-1b6e0d0f6b5a

Reviewed locally (/review + Codex companion), no bots pinged.

Verdict	Reviewer	Finding	Location
IRRELEVANT	codex	Same conservative-absence-check tradeoff already accepted in rounds 1-2; not a new defect introduced by this PR.	ClaudeProviderDescriptor.swift:548
SKIP	claude	The revocation store is a single consistent instance across all its operations, so no marker-identity mismatch exists.	ClaudeProviderDescriptor.swift:1128
SKIP	claude	Only one production call site exists for the new gate, and the default parameter preserves prior fail-closed behavior for any future caller.	ClaudeProviderDescriptor.swift:1119
SKIP	claude	Verified at the guard level that the credential-absence probe cannot trigger a Keychain prompt in any build configuration.	ClaudeProviderDescriptor.swift:997

No FIX or UNVERIFIED findings this round. Cycle complete.

[axisrow]

📋 Review summary — all cycles

Cycle	Reviewer	Finding	Verdict	Resolution
1	codex	Background CLI usage fetch re-permitted every tick after a failed foreground attempt because revocation state was not checked before the OAuth-absence deadlock breaker.	FIX	Fixed in 5e92940
1	claude	Absence-probe closure default only affects the one call site that supplies it; other callers keep prior fail-closed behavior.	HALLUCINATION	Claim did not match the actual single-call-site code
1	claude	DEBUG-only test override does not change production credential-check behavior.	SKIP	Intentional test scaffolding
1	claude	Sequential-branch structure in the availability gate is a maintainability note, not a functional defect.	SKIP	Style/maintainability observation only
1	codex	Conservative absence check reused from explicit OAuth mode does not independently confirm Keychain-only credentials, but this is deliberate pre-existing semantics, not a new bypass.	SKIP	Deliberate, pre-existing, reused semantics
2	codex	Unidentified profiles (no resolvable account marker) could still reach the OAuth-absence fallback, permitting an unbounded background CLI launch with no revocation binding.	FIX	Fixed in e818260
2	codex	Conservative absence check reused from explicit OAuth mode does not independently confirm Keychain-only credentials, but this is deliberate pre-existing semantics, not a new bypass.	SKIP	Restated round-1 SKIP, same resolution
3	codex	Repeat of the round-1 conservative-absence-check observation; no new code path or angle raised.	IRRELEVANT	Third restatement of the same settled theme
3	claude	Revocation store is a single consistent instance across all its read/write operations; no marker-identity mismatch.	SKIP	Verified correct as implemented
3	claude	Exactly one production call site exists for the new gate; the closures default preserves fail-closed behavior for any future caller.	SKIP	Verified correct as implemented
3	claude	Credential-absence probe cannot trigger an interactive Keychain prompt in any build configuration, verified at the guard level.	SKIP	Verified correct as implemented

Totals: 2 FIX (both resolved), 6 SKIP, 1 HALLUCINATION, 1 IRRELEVANT, 0 UNVERIFIED.

Review complete after 3 cycles — no FIX or UNVERIFIED findings remain. Per the review-only-on-merge policy, merging is a manual step for the PR author.