revert: roll back Slice K3 — launchd-spawned daemon can't access keychain

[joedanz]

Summary

K3's research probe was wrong. Reverting #90 to restore the working K1+K1.5+K2 OAuth path.

What broke

K3 deleted MC's OAuth refresher + ~/.mc/credentials.json workaround on the assumption that the SDK's bundled claude binary could resolve auth from the keychain on its own. The probe ran from a terminal session — where the SDK subprocess inherits the terminal's "responsible parent" attribute and can read the keychain.

The actual production daemon is launchd-spawned, which has a different responsible parent and cannot access the user's keychain. After K3 deployed, every agent run failed with:

Claude Code returned an error result: Not logged in · Please run /login

…coming from the bundled claude subprocess itself. The original ~/.mc/credentials.json workaround was specifically designed for this constraint — terminal-spawned mc auth bootstrap reads the keychain (where it works), writes to file 0600, daemon reads file (no keychain at runtime). The README I rewrote even called this out explicitly. I deleted the workaround anyway.

What this PR does

git revert d8c666f — restores everything K3 deleted:

• packages/core/src/auth/ (refresher, credential-store, all readers)
• packages/cli/src/commands/auth.ts (mc auth bootstrap)
• packages/daemon/src/bin/auth-alert.ts (K1.5 Discord DM)
• packages/daemon/src/claude-code-refresh.smoke.test.ts
• mcd-main env-seed, refresher boot probe, credentials-watch
• All dashboard/CLI mc auth bootstrap references

K2's chat-lane fail-fast (AuthRequiredError → CHAT_AUTH_REQUIRED_REPLY) and K1.5's Discord alerts come back automatically since they're tied to the refresher.

Test plan

• Gate 1 — pnpm typecheck clean
• Gate 2 — pnpm build clean
• Gate 3 — biome check . clean
• Gate 4 — pnpm test 1463/1463 (back to pre-K3 count)
• After merge + restart: confirm Discord chat works again
• Capture lesson in tasks/lessons.md

Why I'm not trying a hybrid first

The hybrid options (long-lived claude setup-token token in launchd plist EnvironmentVariables, or a one-shot script that bridges keychain → env) all require the user to manually rotate every few weeks/months. The K1+K1.5 design was explicitly built to solve auto-rotation under launchd. Revert is the cleaner restore-of-known-good.

If we want to revisit cabinet-style migration later, the redo would need a probe from inside a launchd-spawned mcd, not from a terminal — that's the lesson worth capturing.