fix(claude-sdk-oauth): fail closed after logout

[eddieparc]

https://linear.app/jgplabs/issue/LAB-27/claude-로그아웃-후-fallback-응답이-계속-발생함

Problem

With tokenInjection: oauth-slots, /logout deletes the managed pool but the next Claude request silently falls back to ambient Claude CLI credentials. The fallback chain can therefore report Fallback model claude-sdk-oauth/... responded even though the user explicitly logged out.

Fix

Managed oauth-slots and config-dir lanes now fail closed when their pool has no accounts. Intentional ambient mode is unchanged.

Verification

• Added LAB-27 regression proving the SDK query is not called after logout
• Claude auth-lane tests: 11 passed
• npm run check: passed
• Full workspace build: passed
• Sandboxed CLI with an empty agent directory: exits 1 with authentication_failed: No Claude SDK OAuth accounts configured

---

Summary by cubic

Stop silent fallback to ambient Claude credentials after logout in the claude-sdk-oauth auth lane. Requests now fail closed with a clear error when the managed account pool is empty (addresses LAB-27).

• Bug Fixes
  • Managed modes oauth-slots and config-dir now throw authentication_failed: No Claude SDK OAuth accounts configured. Add one with /claude-account add. when no accounts exist.
  • ambient mode behavior is unchanged.
  • Added regression test to ensure the SDK query is not called post-logout; sandboxed CLI with an empty agent dir now exits 1 with the same error.

^{Written for commit 3923f50. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 3 files

_{Re-trigger cubic}

[eddieparc]

CI note: Test (coding-agent 2/3) failed only in unrelated test/mcp/catalog-cache.test.ts (stale_cached remained instead of live tool_1, tool_2). This PR changes only Claude OAuth auth-lane behavior, its regression, and its changes log.

I reran the exact file hermetically with CI=1 npm test -- test/mcp/catalog-cache.test.ts: 6/6 passed. The other 12 PR checks passed. I cannot rerun the failed GitHub job because Actions requires repository admin permission; please rerun the failed shard.