…laude subscription + API key

## What this does

AgentSpec previously required ANTHROPIC_API_KEY for generate and scan.
This change adds full support for Claude Pro/Max subscriptions so users
with a Claude.ai plan can run AgentSpec without any API key.

## New command: agentspec claude-status

Inspect the full Claude auth environment in one shot:

  agentspec claude-status        # table output
  agentspec claude-status --json # machine-readable, exit 1 if not ready

Reports:
- CLI: installed, version, authenticated, account email, plan (Pro/Max/Free)
- API: key set, masked preview, live HTTP probe to /v1/models, base URL
- Env: AGENTSPEC_CLAUDE_AUTH_MODE override, ANTHROPIC_MODEL, resolved mode

Implemented via probeClaudeAuth() in adapter-claude/src/auth.ts which
collects all data without throwing, then renders it in claude-status.ts.

## Auth resolution (CLI first)

resolveAuth() in auth.ts picks the method in this order:
  1. Claude CLI — if installed + authenticated (subscription users)
  2. ANTHROPIC_API_KEY — fallback for CI / API-only setups
  3. Neither — single combined error with setup instructions for both

Override: AGENTSPEC_CLAUDE_AUTH_MODE=cli|api

## CLI stdin fix

runClaudeCli() now pipes the user message via stdin (spawnSync input:)
instead of as a CLI argument, avoiding ARG_MAX limits on large manifests.

## Why not @anthropic-ai/claude-agent-sdk

The agent SDK is designed for persistent multi-turn coding assistants
(session management, resume cursors, tool approval gates). AgentSpec
generate/scan are one-shot calls — the SDK would be ~2500 lines of
adapter code with almost all of it unused. Our spawnSync approach is
the correct scope match: zero extra dependency, auth for free, simple
to test and debug. The only tradeoff is no streaming in CLI mode.

## Files

New:
- packages/adapter-claude/src/auth.ts — resolveAuth, isCliAvailable, probeClaudeAuth
- packages/adapter-claude/src/cli-runner.ts — runClaudeCli via spawnSync stdin
- packages/cli/src/commands/claude-status.ts — new CLI command
- packages/adapter-claude/src/__tests__/auth.test.ts — 16 tests
- packages/adapter-claude/src/__tests__/cli-runner.test.ts — 9 tests
- docs/guides/claude-auth.md — full auth guide incl. claude-status usage
- examples/gymcoach/docker-compose.yml — local Postgres + Redis

Updated:
- adapter-claude/index.ts — routes generate/repair through resolveAuth
- cli/commands/generate.ts + scan.ts — remove hard API key blocks, show auth label
- cli/cli.ts — registers claude-status command
- docs/reference/cli.md — claude-status section, updated generate/scan auth docs
- docs/concepts/adapters.md + quick-start.md — dual-auth examples throughout

Tests: 63 passing in adapter-claude, 1039 passing workspace-wide

Remove all Claude-specific hardcoding from the generic codegen pipeline.
The CLI, types, and docs now use provider-agnostic language throughout.

Renames:
- claude-status command → provider-status
- probeClaudeAuth() → probeProviders()
- ClaudeProbeReport → ProviderProbeReport
- ClaudeApiProbe → AnthropicApiProbe
- ClaudeEnvProbe → ProviderEnvProbe
- auth-probe.ts → provider-probe.ts
- docs/guides/claude-auth.md → provider-auth.md
- resolvedMode: 'cli'|'api' → resolvedProvider: string|null
- authModeOverride → providerOverride
- AGENTSPEC_CLAUDE_AUTH_MODE → AGENTSPEC_CODEGEN_PROVIDER

Adds E2E cross-functionality tests covering the full
resolver → provider-probe → provider-status pipeline.