fix(claude): prefer current macOS Keychain credential - #6093

Code changes: +21 -24
Tests: +54 -0
Others: +0 -0

Related issue: #6105. This fixes the reproduced Keychain credential-selection failure; the affected Mac’s Keychain state is unverified.

Summary

• Prefer the current Claude Code macOS Keychain service when resolving a local Claude credential. Keep Claude Code-credentials as a fallback for older installations.
• Reproduce a false signed-out result with both entries present: an obsolete OAuth credential gets HTTP 401 while the managed key succeeds. Before the change, AO selects the obsolete entry and marks Claude unauthorized; after the change, its provider probe accepts the managed key.

Validation

• go test -race -count=1 ./pkg/agentcreds ./internal/adapters/agent/claudecode ./internal/service/agent — passed.
• go build ./..., go vet ./..., golangci-lint v2.13.2 — passed.
• go test -tags e2e -v ./internal/cli/... — passed with the AO session environment removed.
• npm run sqlc and npm run api — passed with no generated-file drift.
• Full go test -race -count=1 -timeout=20m ./... ran locally. The changed packages passed. Goose, tmux, CLI, and system-check failures cleared in a clean-environment rerun. Codex protocol conformance still fails against this machine's installed Codex version; it is unrelated to this change. Remote CI remains the full-suite gate.
• The Docker fresh-install check and native Linux/Windows jobs were unavailable locally; verify their CI results.

Scope and risk

This proves one code path that can produce the reported mismatch; the reporter's Keychain contents have not been inspected. A stale Claude Code entry on a machine actively using an older Claude version and its legacy entry could cause the reverse mismatch. Environment-supplied credentials and differing Claude binaries are outside this fix.