fix(claude): read credentials from ~/.claude/.credentials.json

The actual OAuth token is in ~/.claude/.credentials.json under
claudeAiOauth.accessToken, not in ~/.claude.json.
~/.claude.json holds only UI state and profile metadata (oauthAccount
has no token fields). expiresAt in the credentials file is milliseconds,
not seconds.

Discovered after testing against Claude Code 2.1.198.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/unit/test_agent_provider.py

@@ -294,12 +294,13 @@ class TestAgentProviderRuntime(unittest.TestCase):
         self.assertEqual({}, plan.provisioned_env)
 
     def test_claude_forward_host_credentials_populates_egress_route(self):
-        session_key = "sk-ant-oat01-test-key"
+        access_token = "sk-ant-oat01-test-key"
         with tempfile.TemporaryDirectory(prefix="bb-provider.") as tmp:
             home = Path(tmp) / "host-claude"
-            home.mkdir()
-            (home / ".claude.json").write_text(json.dumps({
-                "oauthAccount": {"sessionKey": session_key},
+            cred_dir = home / ".claude"
+            cred_dir.mkdir(parents=True)
+            (cred_dir / ".credentials.json").write_text(json.dumps({
+                "claudeAiOauth": {"accessToken": access_token},
             }))
             plan = build_agent_provision_plan(
                 template="claude",
@@ -319,12 +320,13 @@ class TestAgentProviderRuntime(unittest.TestCase):
         self.assertEqual(frozenset({"CLAUDE_CODE_OAUTH_TOKEN"}), plan.hidden_env_names)
 
     def test_claude_forward_host_credentials_populates_provisioned_env(self):
-        session_key = "sk-ant-oat01-test-key"
+        access_token = "sk-ant-oat01-test-key"
         with tempfile.TemporaryDirectory(prefix="bb-provider.") as tmp:
             home = Path(tmp) / "host-claude"
-            home.mkdir()
-            (home / ".claude.json").write_text(json.dumps({
-                "oauthAccount": {"sessionKey": session_key},
+            cred_dir = home / ".claude"
+            cred_dir.mkdir(parents=True)
+            (cred_dir / ".credentials.json").write_text(json.dumps({
+                "claudeAiOauth": {"accessToken": access_token},
             }))
             plan = build_agent_provision_plan(
                 template="claude",
@@ -336,7 +338,7 @@ class TestAgentProviderRuntime(unittest.TestCase):
                 host_env={"HOME": str(home)},
             )
         self.assertEqual(
-            {CLAUDE_HOST_CREDENTIAL_TOKEN_REF: session_key},
+            {CLAUDE_HOST_CREDENTIAL_TOKEN_REF: access_token},
             plan.provisioned_env,
         )