Subscription AI providers: Claude Code & Codex (headless, secure)

[JSONbored]

Part of #975. Builds on the pluggable AI provider seam (sibling sub-issue).

Context

Many maintainers have a Claude (Pro/Max) or ChatGPT (Plus/Pro) subscription that includes large agent/CLI usage but not pay-per-token API access. Let self-hosters use that subscription to run reviews with frontier models via the official agent CLIs — no API key, no extra cost. Both are confirmed viable as headless backends (single-operator self-host: your subscription, your repos).

Deliverables

• claude-code-subscription provider — headless, single-shot structured (JSON-schema) output via the official Claude agent SDK/CLI; authenticated with the user's subscription credential (long-lived OAuth token), no API key.
• codex-subscription provider — headless codex exec single-shot structured output; authenticated with the user's ChatGPT subscription (sign-in-with-ChatGPT / device-auth; credential file mounted into the container), no API key.
• Secure credential handling: credential isolated from the review process (scrubbed from the child env that processes untrusted PR content; never logged or baked into images); execution is read-only, network-restricted, sandboxed; pinned config; no extra tools enabled.
• Prompt-injection hardening retained on all untrusted PR content before it reaches the CLI.
• Both providers behind the seam (Storage & infrastructure adapters (OSS-selectable backends) #977); fail-safe to the fallback chain → manual on auth/timeout/limit failure.
• Per-project model selection (frontier model on the user's plan).

Acceptance criteria

• A self-hoster sets one credential + selects the provider and gets frontier-model reviews on their own subscription.
• The credential is never exposed to reviewed PR content (verified by test).
• Hitting the plan's usage limit or any failure degrades gracefully (chain → manual), never a wrong action.

Security notes (must-do)

• Treat the subscription credential like a live secret (secrets manager / mounted secret file, access-controlled, rotatable).
• Run the agent with the minimum capability (read-only, no write/exec/network-beyond-provider, hooks off, fixed endpoint).
• Never let an API-key env var silently override the subscription credential (would bill the API).

Out of scope

• Multi-tenant credential routing (a hosted service routing many users' subscriptions) — that is a different model and not part of self-host.