Add Claude OAuth token guardrail and align Quick Start secret commands with gh aw secrets set

[Copilot]

DDUh flagged two recurring Quick Start gaps that had prior docs-only PRs closed unmerged: unsupported CLAUDE_CODE_OAUTH_TOKEN was only documented elsewhere, and Quick Start still used shell-redirect gh secret set examples. This change addresses those gaps by moving one into executable validation and updating Quick Start to the repo’s existing secrets helper flow.

• Claude auth rejection is now enforced in CLI paths

  • Added early validation for compile/run flows when Claude is selected.
  • If CLAUDE_CODE_OAUTH_TOKEN is present for a Claude workflow, CLI returns a direct remediation error: use ANTHROPIC_API_KEY.
  • Validation runs for explicit engine override and per-workflow engine detection.

• Quick Start now uses the supported secret setup UX

  • Replaced redirect-based examples:
    • gh secret set ... < /path/to/...
  • With helper command examples:
    • gh aw secrets set ... --value "..."

• Focused implementation surface

  • New Claude token validation helper + tests.
  • Small compile/run integration points to invoke the guardrail.
  • Minimal doc updates in setup/quick-start.mdx.

if strings.EqualFold(engine, "claude") && os.Getenv("CLAUDE_CODE_OAUTH_TOKEN") != "" {
    return fmt.Errorf("CLAUDE_CODE_OAUTH_TOKEN is not supported for Claude workflows - set ANTHROPIC_API_KEY instead")
}

gh aw secrets set ANTHROPIC_API_KEY --value "YOUR_ANTHROPIC_API_KEY"