Previously `external-agents audit` only touched entries with a
generate_new HTTP transport (verifyCredential path). CLI-only entries
(codex, claude-*, cursor-agent, opencode, kiro) were silently skipped —
so quota_exhausted / needs_auth situations only surfaced AFTER a real
dispatch failed. Kiro's "Monthly request limit reached" and opencode's
usage-cap conditions were invisible in audit output.

New: auditCliEntry() spawns the edit_exists command headless with a
trivial prompt ("reply exactly OK"), captures stderr+stdout with a 20s
timeout, then classifies via the same regex family runAny uses in the
post-dispatch path (0.20.0):

  exit 0                          → healthy         "verified (Nms) (cli)"
  "monthly limit" / "usage limit" → quota_exhausted
  "not logged in" / "please login" → needs_auth
  other non-zero                   → errored_transient (with last line as hint)

State written via same deep-merge as HTTP audit. UI/pick immediately
reflect reality across BOTH transport classes.

Also: added `quota_exhausted` glyph (⏳) to the audit summary table so
the CLI output distinguishes quota from rate_limit at a glance.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>