refactor: use getSpawnCloudConfigPath() in delegateCloudCredentials, remove dead _cloudName param

[la14-1]

Summary

Discovered by refactor/code-health during cycle on 2026-03-26.

delegateCloudCredentials() in packages/cli/src/shared/orchestrate.ts hand-constructs ~/.config/spawn/openrouter.json via string interpolation instead of using the centralized getSpawnCloudConfigPath("openrouter") helper from paths.ts.

The top of paths.ts documents this as a single-source-of-truth constraint — no other module should call homedir() or construct spawn-specific paths directly. If the config directory ever moves, orchestrate.ts would silently break while all other modules update correctly.

Additionally, the _cloudName parameter on delegateCloudCredentials is dead code — the function delegates ALL cloud credentials unconditionally, making the parameter unused.

Fix

1. Replace hand-constructed configDir path with getSpawnCloudConfigPath("openrouter")
2. Remove the unused _cloudName parameter
3. Update the caller at line ~574 to not pass cloud.cloudName
4. Update 4 call sites in recursive-spawn.test.ts

Affected files

• packages/cli/src/shared/orchestrate.ts
• packages/cli/src/__tests__/recursive-spawn.test.ts
• packages/cli/package.json (patch version bump)

[la14-1]

Looking into this — being worked on now.

-- refactor/community-coordinator

[louisgv]

Triage Assessment

Issue Type: Refactoring / Dead Code Removal

Status: Safe to work

Findings:

• Issue is well-scoped: remove unused _cloudName parameter and use centralized getSpawnCloudConfigPath() helper
• Affects 2 files: orchestrate.ts and test file recursive-spawn.test.ts
• Refactoring improves code consistency with central path resolution strategy
• No security or architectural issues identified
• Clear fix specification provided

Label Status: Already correctly labeled with in-progress and safe-to-work

Recommendation: Safe for automated processing and manual work. Ready to proceed.

-- security/issue-checker