feat: add subscription-first API billing fallback

[RobertTLange]

Codex experiments requesting GPT-5.4 failed when authenticated through ChatGPT, while Claude experiments stopped at shared subscription usage limits. This change defaults noninteractive Claude/Codex runs to subscription-first billing and resumes eligible failures once through paid authentication.

• Add --billing auto|subscription|api, HEADLESS_BILLING, and per-agent config, in that precedence order. GPT-5.4 and its dated snapshot use OpenAI API directly. Codex's paid route uses CODEX_API_KEY/OPENAI_API_KEY; Claude's uses Amazon Bedrock with existing AWS credentials.
• Recognize native subscription quota/model-access failures. Preserve native session, workspace, permissions, reasoning effort, and the original deadline; resume partial work with a continuation prompt. Missing backup credentials or unsafe resumption terminate with status 78. Generic errors, tool prose, interruptions, and timeouts cannot trigger billing changes.
• Apply auth changes only to child environments, with guards against conflicting stored credentials/config. Support local, Docker, and Modal execution; retain Docker recovery files after failures and reuse one Modal sandbox. Explicit billing selection is rejected for tmux.
• Report each attempt's route and usage provenance, aggregate tokens, and keep incompatible cost valuations separate. Custom Codex profiles/providers retain native routing under auto.

Validation:

• TypeScript build and npm package dry run passed.
• 95 focused billing/transport tests passed.
• Full test run: 636 passed, 3 skipped, 1 failed. The failing tmux cleanup timing test also fails in the unchanged checkout (approximately 24 seconds against a 10-second assertion).
• Live native checks passed for GPT-5.4 API execution, Codex subscription-to-API session continuity, and Claude subscription-to-Bedrock session continuity.
• Docker simulations passed both fallback routes, session/workspace retention, credential masking, and two-attempt usage reporting. Modal behavior covered with mocked sandbox tests; no live Modal run.

Operational notes: paid backup credentials must be available inside the execution environment; provider limits still apply and there is no local dollar cap. --billing subscription disables paid fallback. Agentic Scientist's companion branch pins this exact Headless revision (79bbe66f0fc48557eed9b878dd79daf0ef9487e4).

[RobertTLange]

Addressed all five review findings in separate commits:

• 8a1c7a4 — Reject paid backend settings in Claude's global configuration before accepting subscription-only billing. Covers default, custom-directory, and legacy config paths.
• d07aacd — Apply unset-variable masks inside Docker before native execution, preventing image-defined paid credentials or backend selectors from bypassing the selected route.
• 6f1813d — Restore Docker session profiles before billing validation, while still rejecting unsupported billing before creating a native session.
• 0c3a4a9 — Use a Docker-managed temporary volume for anonymous Windows billing retries. Both attempts share it; initialization consumes the original deadline; success removes it and failure reports its name for recovery. Named durable Windows sessions retain their existing restriction.
• a8a9952 — Preserve Bedrock's provider identity in usage reports and restrict estimates to that provider's pricing. Missing Bedrock prices remain unavailable instead of borrowing another provider's rates.

Validation:

• All six CI jobs passed for a8a9952 (run 34346621667). Windows/Node 24 passed on rerun after an initial failure in the unchanged process-identity test.
• Regression cases reproduced before their fixes; focused checks and per-commit/final integration reviews passed.
• TypeScript build and npm package dry run passed. Dependency installation audit: zero vulnerabilities.
• Full local gate with umask 022: 649 passed, 3 skipped, 1 failed. The only failure is the unchanged tmux cleanup timing test: about 23 seconds against its 10-second assertion. This also reproduced on main during review.
• Focused billing/usage coverage: 98.94% lines, 90.96% branches.

Windows volume lifecycle is covered by platform simulations with a fake Docker executable, including successful fallback, failed execution, cleanup failure, and initialization timeout. No live Windows/Docker validation was available.

No findings deferred. Review findings originated in the conversation; there were no GitHub review threads to resolve.