Highlights:
- Fix SDK runtime smoke CI — root caused gh-secret-set pipe truncation
bug (see scitex-git 0.3.0); CI is now green end-to-end against real
Anthropic OAuth credentials.json mount.
- Enforce SAC_ prefix on all sac env vars: rename 18 SCITEX_AGENT_*
vars → SAC_* (kept SCITEX_AGENT_CONTAINER_* per long-form convention).
Breaking for external consumers reading those env vars.
- Rename GH secret CLAUDE_CREDENTIALS_JSON → SAC_CLAUDE_CODE_CREDENTIALS_JSON
(matches SAC_ prefix + newb's NEWB_CLAUDE_CODE_CREDENTIALS_JSON).
- ClaudeAgentOptions: setting_sources=[] (matches newb; prevents the
SDK from auto-loading host ~/.claude state into the container).
- container.py: drop --user override + HOME=/tmp hack; let image's
agent user stand. RW credentials.json bind-mount for OAuth refresh.
- Require scitex-git>=0.3.0 (gh-pipe fix).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>