Surface actionable auth-failure message in step and tracking comment

[maksmarcinkiewicz]

Fixes #1501

When the API rejects the run's credentials (expired/revoked claude_code_oauth_token or invalid anthropic_api_key), the failure was generic and the tracking comment gave no cause, so an expired token surfaced as an unexplained ~2s failure. #1496 already makes such runs fail the step; this PR adds the cause and the fix instructions.

Changes

• base-action/src/run-claude-sdk.ts: on a failed result, check api_error_status; for 401/403 the error is now "authentication failed (API returned 401). If you use claude_code_oauth_token, regenerate it with claude setup-token; …" instead of the generic message
• src/entrypoints/run.ts, src/entrypoints/update-comment-link.ts: surface the execution-phase error message in the tracking comment, the same way prepare-phase errors already are
• regression test for the 401 case

Verification

New test fails on the previous code and passes with the fix. bun test 771/771, bun run typecheck and bun run format:check clean.