fix(claude): use run token for ccrotate auth

[kkroo]

Thinking Path

• Paperclip is the control plane that schedules and supervises AI-agent workers.
• The Claude local/k8s adapter constructs the environment used when a Paperclip run launches Claude Code.
• Blockcast routes Claude traffic through ccrotate by setting ANTHROPIC_BASE_URL to the Paperclip ccrotate endpoint.
• Paperclip injects a short-lived run JWT as PAPERCLIP_API_KEY; that token is valid for Paperclip and ccrotate bearer auth during the run.
• The runtime image can also carry process-level Anthropic credential env vars, but those are not valid bearer credentials for ccrotate.
• When an agent config points Claude at ccrotate without explicit Anthropic auth, Claude inherits the stale process credential and ccrotate rejects it with 401 missing or malformed bearer token before any model tokens are used.
• This pull request maps the valid run JWT into Claude's Anthropic auth env only for ccrotate base URLs and only when the agent did not explicitly configure Anthropic auth.
• The benefit is that agents such as Ally can use ccrotate without storing long-lived Paperclip API keys in adapter config.

Linked Issues or Issue Description

What happened?

Claude k8s agents using ANTHROPIC_BASE_URL=https://paperclip.blockcast.net/ccrotate can fail immediately with API Error: 401 {"error":"missing or malformed bearer token"}. A live Ally run showed zero model usage and valid PAPERCLIP_API_KEY, while ANTHROPIC_AUTH_TOKEN / ANTHROPIC_API_KEY were inherited 64-byte process credentials that ccrotate rejects.

Expected behavior

When Paperclip launches Claude against a ccrotate Anthropic base URL, the Claude process should authenticate to ccrotate with the short-lived Paperclip run JWT already injected as PAPERCLIP_API_KEY, unless the agent explicitly configured Anthropic auth env vars.

Steps to reproduce

1. Configure a Claude agent with ANTHROPIC_BASE_URL pointing at the Paperclip ccrotate endpoint and no explicit ANTHROPIC_AUTH_TOKEN / ANTHROPIC_API_KEY in the agent adapter config.
2. Launch a Paperclip Claude run from an image/environment that also has process-level Anthropic auth vars set.
3. Observe Claude fail before model execution with 401 {"error":"missing or malformed bearer token"} from ccrotate.

Paperclip version or commit

Reproduced on deployed commit 7d628ce48e7e722349e7908e858e304787292eae.

Deployment mode

Self-hosted Kubernetes server using the Claude local/k8s adapter.

What Changed

• Detect ccrotate Anthropic base URLs in the Claude adapter runtime env builder.
• When a Paperclip run JWT is available, copy it into ANTHROPIC_AUTH_TOKEN and ANTHROPIC_API_KEY for ccrotate calls unless the agent explicitly configured those env keys.
• Added regression tests for stale inherited Anthropic process credentials and explicit agent-provided auth preservation.

Verification

• pnpm exec vitest run packages/adapters/claude-local/src/server/execute.remote.test.ts
• pnpm --filter @paperclipai/adapter-claude-local typecheck

Risks

Low risk. The change is scoped to Claude adapter env construction and only activates when ANTHROPIC_BASE_URL looks like ccrotate and PAPERCLIP_API_KEY exists. Explicit agent-provided Anthropic auth remains preserved.

For core feature work, check ROADMAP.md first and discuss it in #dev before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See CONTRIBUTING.md.

Model Used

OpenAI GPT-5 via Codex coding agent, with shell, Kubernetes, and GitHub tool use.

Checklist

• I have included a thinking path that traces from project context to this change
• I have specified the model used (with version and capability details)
• I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work
• I have searched GitHub for duplicate or related PRs and linked them above
• I have either (a) linked existing issues with Fixes: # / Closes # / Refs # OR (b) described the issue in-PR following the relevant issue template
• I have run tests locally and they pass
• I have added or updated tests where applicable
• If this change affects the UI, I have included before/after screenshots
• I have updated relevant documentation to reflect my changes
• I have considered and documented any risks above
• All Paperclip CI gates are green
• Greptile is 5/5 with no open P2s, recommendations, or follow-ups
• I will address all Greptile and reviewer comments before requesting merge

[allyblockcast]

Hey @kkroo! Before this PR can be reviewed, a few things need attention:

Missing or incomplete:

• No linked issue or inline issue description found — either tag an existing issue with Fixes #NNN / Closes #NNN / Refs #NNN, or describe the underlying issue inline in the PR body following one of our issue templates (https://github.com/paperclipai/paperclip/tree/master/.github/ISSUE_TEMPLATE). See CONTRIBUTING.md → "Link Issues or Describe Them In-PR".

Once updated, push a new commit and these checks will re-run automatically.

— commitperclip