Some CLIs exit 0 while printing an auth or quota error instead of a
real response. Prior 0.21.0 auditCliEntry() checked exit code first,
so those cases came back as healthy — the exact false-positive the
operator flagged for kiro (which prints "Monthly request limit reached"
on stdout but exits 0 anyway).

Rewrite the classification order:

  1. quota regex (any output containing "monthly limit reached", "usage
     limit", "hit your usage limit", "quota exhausted", "rate limit",
     "too many requests")
  2. auth regex (any output containing "not logged in", "please run
     /login", "AuthorizationRequired", "invalid api key", "oauth
     revoked/expired")
  3. If exit==0, verify the expected marker "OK" (case-insensitive) is
     in stdout. Otherwise → errored_transient with "response did not
     include expected marker (got: ...)". Prevents "quiet success" false
     positives where a CLI printed startup noise but no real response.
  4. Otherwise non-zero → errored_transient with last stderr line as hint

Live-verified:
  claude-opus-4-8/4-7/sonnet-5/haiku-4-5   → healthy   (subscription OK
      with env-strip prefix; --print resolves OAuth from ~/.claude,
      the operator's earlier "does subscription work with --print?"
      concern is unfounded once ANTHROPIC_BASE_URL is unset)
  opencode                                  → healthy
  kiro                                      → quota_exhausted
      with actual message "Monthly request limit reached" surfaced
      as note. Previously reported healthy because exit was 0.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>