fix(auth): honor anthropic credential pool oauth

[LeonSGP43]

What does this PR do?

Fixes Anthropic runtime credential resolution for OAuth-only Hermes setups. resolve_anthropic_token() now consults the Anthropic credential_pool after Claude Code credentials and before the ANTHROPIC_API_KEY fallback, so cron and runtime paths can reuse Hermes-native PKCE auth stored in ~/.hermes/auth.json.

Related Issue

Fixes #26344

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• Added _resolve_anthropic_pool_token() in agent/anthropic_adapter.py to enumerate the Anthropic credential_pool, refresh expiring OAuth entries through the existing pool machinery, and return the first available OAuth token.
• Updated resolve_anthropic_token() priority order so Hermes PKCE entries in ~/.hermes/auth.json are considered before falling back to ANTHROPIC_API_KEY.
• Added regression tests in tests/agent/test_anthropic_adapter.py covering pool-only resolution and pool-OAuth precedence over ANTHROPIC_API_KEY.

How to Test

1. Run python3 -m pytest -o addopts='' tests/agent/test_anthropic_adapter.py -k 'resolve_anthropic_token or auto_refresh_on_expired_creds or static_env_oauth_token_does_not_block_refreshable_claude_creds'.
2. Run python3 -m py_compile agent/anthropic_adapter.py tests/agent/test_anthropic_adapter.py.
3. Run git diff --check.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS 15.5

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Screenshots / Logs

• Targeted verification passed:
  • python3 -m pytest -o addopts='' tests/agent/test_anthropic_adapter.py -k 'resolve_anthropic_token or auto_refresh_on_expired_creds or static_env_oauth_token_does_not_block_refreshable_claude_creds'
  • python3 -m py_compile agent/anthropic_adapter.py tests/agent/test_anthropic_adapter.py
  • git diff --check
• Full tests/agent/test_anthropic_adapter.py still has 3 preexisting unrelated failures on main in TestRunOauthSetupToken because those tests patch subprocess.run with a MagicMock lacking .stdout, which breaks the keychain read path before this PR's code runs.

[ByteSide]

Reporter here — thanks for the quick turnaround.

The pool-API path with native refresh is the right call for our deployment: we hit this on a Hermes-PKCE-only setup with multiple cron jobs spanning token-expiry boundaries (e.g. morning briefings after overnight access-token expiry). A raw pool read without the refresh layer would have only pushed the failure to the next expiry window.

Happy to validate against our PKCE-only deployment once merged.