Previous version derived 4 access-mode tags per row (cli/api/subscription/
apikey) — visually noisy and semantically overlapping. Every registry
entry falls into exactly one of two auth camps:

  auth: "cli:*"  → tag `cli`     (subscription-backed CLI: Codex, Claude,
                                  Cursor, Kiro, opencode, aider-via-CLI)
  auth: "env:*"  → tag `apikey`  (API-key env var: Gemini, Groq, DeepSeek,
                                  OpenRouter, Z.ai, Ollama-cloud)

Mutually exclusive by construction. Drops the transport-based `api` tag
(redundant with apikey) and the separate `subscription` tag (redundant
with cli). Result: at most one access-mode tag per row, cleaner scan.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>