Co-authored-by: Colin McDonnell <[email protected]>

… or a checkout written for V2 (#1597)

* models: resolve a Kimi Code specifier to its provider, so its key gates and auto-select see KIMI_API_KEY

* opencode: run OpenCode V2 beside V1 for a trial window, behind PULLFROG_OPENCODE_VERSION=2 or a checkout written for V2

* test: accept V2's skill tool input (`id`) in the opencode skill-invoke check

* opencode2: carry each session's usage baseline across turns, so a failed session.get defers its growth instead of re-billing its history

* openCodeHomeEnv: name the seeded catalog only once the seed wrote it, since V2 ignores its own downloads while OPENCODE_MODELS_PATH is set

* opencode2: usageSince's doc names the carried baseline, not the turn's start

…a request for structure feedback survives Review's drop rules (#1598)

…ead of a stored key (#1600)

* Keyless auth: Anthropic and OpenAI runs sign in with GitHub OIDC instead of a stored key

* Keyless gateway: pin requests to the provider origin, survive a client dropped mid-body, and serve the old token while a refresh runs

* Keyless auth falls through on a missing ID or a customer base URL instead of failing every run in the org

* Provider cards list a key as "API key", never by its variable name

* Anthropic keyless rule spelled in the Claude Console wizard's own fields, allowing workflow_dispatch

* Anthropic keyless rule suggests Any event and the owner's numeric GitHub ID, as the Console wizard asks

* Anthropic keyless rule matches the owner's numeric ID claim, so GitHub's immutable OIDC subjects match too

* wiki/keyless-auth: preview e2e evidence

* Keyless rule block never shows repo:* without an owner claim; a failed GitHub lookup falls back to the owner's name