test(agent): isolate anthropic oauth setup token from macos keychain

[fyzanshaik]

Fixes #58415

The setup-token tests mock subprocess.run to cover the claude setup-token subprocess. On macOS, credential resolution also shells out through subprocess.run to read Claude Code credentials from Keychain, so those tests were feeding the Claude CLI MagicMock into the Keychain JSON parser.

This keeps the setup-token seam focused by stubbing the Keychain credential reader to return None for the TestRunOauthSetupToken class. File credentials and env-var fallbacks remain exercised, but macOS Keychain subprocess behavior is tested independently.

Tests:

• scripts/run_tests.sh tests/agent/test_anthropic_adapter.py

[teknium1]

Thanks for the focused test-isolation fix. No blocking problems found.

run_oauth_setup_token() invokes subprocess.run() for claude setup-token at agent/anthropic_adapter.py:1350, then resolves credentials at agent/anthropic_adapter.py:1355. On Darwin, that resolution reaches the Keychain subprocess at agent/anthropic_adapter.py:872-911. Current TestRunOauthSetupToken mocks the same subprocess seam at tests/agent/test_anthropic_adapter.py:684-686, so the added class-local Keychain stub correctly keeps the mock scoped to the Claude CLI path while preserving file and environment fallback assertions. Dedicated Keychain coverage remains in tests/agent/test_anthropic_keychain.py:14-91.

This is an automated hermes-sweeper review.

[teknium1]

Thanks @fyzanshaik — closing as resolved on main: the suite-wide autouse _neutralize_macos_keychain_creds guard from PR #74517 (via #35464) covers the anthropic oauth setup tests. Earliest credit on the keychain-mock class goes to #35093 (May 30). Verified post-merge (84/84 adapter tests green).