fix: re-auth on stale OAuth token; read Claude Code credentials from macOS Keychain

[5park1e]

Summary

Fixes #12905 — two bugs in the Anthropic provider OAuth flow:

### Bug 3: Stale OAuth token not detected in `hermes model`

`_model_flow_anthropic` used `has_creds = bool(existing_key)` which treats any non-empty token (including expired OAuth tokens) as valid. This caused `hermes model` to skip the re-auth flow entirely when only a stale OAuth token was present.

**Fix**: Added `existing_is_stale_oauth` check — if the only credential is an OAuth token (`sk-ant-` prefix) with no valid `cc_creds` fallback, mark it stale and force the re-auth menu.

### Bug 4: macOS Keychain credentials never read

Claude Code >=2.1.114 migrated credentials from `~/.claude/.credentials.json` to the macOS Keychain under service `"Claude Code-credentials"`. `read_claude_code_credentials()` only read the JSON file, so credentials were silently unavailable.

**Fix**: Added `_read_claude_code_credentials_from_keychain()` using the `security` CLI. `read_claude_code_credentials()` now tries Keychain first (Darwin only) then falls back to the JSON file.

## Changes

| File | Change |
|------|--------|
| `hermes_cli/main.py` | +11 lines: stale OAuth detection before `has_creds` |
| `agent/anthropic_adapter.py` | +72 lines: Keychain read via `security` CLI + Keychain-first lookup |
| `tests/agent/test_anthropic_keychain.py` | NEW (165 lines, 11 cases) |
| `tests/hermes_cli/test_anthropic_model_flow_stale_oauth.py` | NEW (210 lines, 8 cases) |

## Test Plan

- [x] New unit tests added (19 cases total)
- [ ] Manual testing on macOS with Claude Code >=2.1.114
- [ ] Manual testing with expired OAuth token in `.env`

## Type of Change

- [x] 🐛 Bug fix (non-breaking change that fixes an issue)
- [ ] ✅ Tests (adding or improving test coverage)

## Checklist

- [x] I've read the Contributing Guide
- [x] My commit messages follow Conventional Commits
- [x] My PR contains only changes related to this fix
- [ ] I've tested on macOS (required for Bug 4 Keychain testing)

[teknium1]

Thanks for the contribution, @5park1e! Both fixes from this PR have already landed on main via your own commit.

This is an automated hermes-sweeper review.

Evidence:

• Commit e1106772d — fix: re-auth on stale OAuth token; read Claude Code credentials from macOS Keychain — is confirmed reachable from main (git branch --contains e1106772d → * main).
• hermes_cli/main.py lines 4346–4350: existing_is_stale_oauth detection present.
• agent/anthropic_adapter.py line 470: _read_claude_code_credentials_from_keychain() defined and called at line 545.
• Both new test files (tests/agent/test_anthropic_keychain.py, tests/hermes_cli/test_anthropic_model_flow_stale_oauth.py) exist on disk.

The commit landed after the v2026.4.23 release tag, so it will ship in the next tagged release. Closing as implemented.