fix(claude): don't log the raw identity token in supervise MCP recovery hint

The previous fix interpolated the real per-bottle identity token into the
`warn()` message shown when `claude mcp add supervise` fails, so a
registration failure would leak the credential into host terminal output
and any collected launch logs (#476 review, PR #471 comment).

Render a `<bottle-identity-token>` placeholder instead. The recovery hint
still shows the required `--header x-bot-bottle-identity: …` shape, and the
operator substitutes the value from inside the bottle (it rides in the
agent's HTTPS_PROXY credentials) — so the token never reaches the host log.
The token truthiness still gates whether the header is shown at all.

Test updated to assert the header name and placeholder are present and the
raw token is absent.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/unit/test_contrib_claude_provider.py

@@ -353,7 +353,9 @@ class TestClaudeSuperviseMcp(unittest.TestCase):
             _plan(supervise=True), bottle, _URL,
         )
 
-    def test_fallback_warning_includes_identity_header(self):
+    def test_fallback_warning_includes_header_but_not_raw_token(self):
+        # The recovery hint must show the header is required, but must NOT
+        # render the per-bottle identity token into the host log (#476 review).
         bottle = _make_bottle(
             exec_result=ExecResult(returncode=1, stdout="", stderr="boom"),
         )
@@ -363,7 +365,8 @@ class TestClaudeSuperviseMcp(unittest.TestCase):
             )
         msg = warn_mock.call_args.args[0]
         self.assertIn("x-bot-bottle-identity", msg)
-        self.assertIn("tok-xyz", msg)
+        self.assertNotIn("tok-xyz", msg)
+        self.assertIn("<bottle-identity-token>", msg)
 
     def test_fallback_warning_omits_header_when_no_token(self):
         bottle = _make_bottle(