fix(oauth): reject read-only credentials before starting login

[rudycelekli]

• Reject the built-in read-only environment credential store before starting provider authentication.
• Previously login completed the provider flow, then discovered it could not save the result. A supplied writable store still takes precedence over the environment variable.
• Reuse the same store error for login, set and remove; retain logout's absent-login behavior. Add docs, consumer guidance and a changeset.

Verified

Ran it locally: yes

Invoked the actual built CLI in a temporary project with E2E_OAUTH_CREDENTIALS={} and e2e login github-copilot --client-id local-proof. Only that process's provider fetch was routed to a controlled loopback HTTP endpoint. No external credentials, browser authorization, model or provider account was used.

main	branch
Sends a device-code request despite the read-only store; the held endpoint requires bounded process cleanup	Sends no HTTP request and exits1 with the existing MISCONFIGURED explanation
Two new preflight regressions fail	Default/explicit read-only stores refuse before provider login; the writable-store control passes

E2E_OAUTH_CREDENTIALS is set, so logins come from the environment and cannot be changed here; unset it to sign in on this machine

• Full core unit suite:2453 passed, one skipped. Core typecheck and all seven package builds pass.
• Full built CLI testbed:71 passed, one skipped. Its temporary4295 port change was restored before commit.
• Lint, docs build validation and broken links pass. Separate fresh-context review found no critical or important findings.
• pnpm check stops at the filtered install's unused Expo mobile dependency finding, also observed on main. Full native mobile verification requires those omitted dependencies. No runner, engine or model behavior was changed.
• Fork Actions require upstream maintainer authorization. Hosted CI is not claimed green.

AI assistance: implemented and independently reviewed with Codex, with built CLI before/after evidence.

Current-head workflows awaiting maintainer authorization: docs, mobile, benchmark, spec.

Updated verification (October 6)

Moved afterEach into the login describe, kept only the requested unset-before-login sentence, and removed the skills addition. Focused tests and the rebuilt CLI readonly-store consumer pass.

Direct package typecheck and lint pass. The full monorepo check remains blocked at the same missing filtered mobile-benchmark dependency on untouched main; the current full Next benchmark was not rerun with this lean dependency environment. Hosted fork workflow authorization is reported separately; I am not marking these Ready for Human Review.

[cubic-dev-ai]

No issues found across 6 files

_{Re-trigger cubic}

[okwasniewski]

Makes sense, failing before the flow beats failing after it. Small asks: move the afterEach into the login describe, keep only "unset it before e2e login" in subscriptions.mdx, and drop the skills/setup.md change.

[rudycelekli]

[gpt-6.1-sol] responding on behalf of rudycelekli

Moved afterEach into the login describe, kept only the requested unset-before-login sentence, and removed the skills addition. Focused tests and the rebuilt CLI readonly-store consumer pass.

Direct package typecheck and lint pass. The full monorepo check remains blocked at the same missing filtered mobile-benchmark dependency on untouched main; the current full Next benchmark was not rerun with this lean dependency environment. Hosted fork workflow authorization is reported separately; I am not marking these Ready for Human Review.