fix(usage): read keychain credential by account, not service name alone - #532

Upstream: Extra Usage Limit widget (sirmalloc#756), live widget preview while picking (sirmalloc#755), Fast Mode widget (sirmalloc#754), transcript block fallback fixes (sirmalloc#752), editor keys on a global install (sirmalloc#751), git cache TTL (sirmalloc#750), npx cached copy skip (sirmalloc#749), Block Usage hide at 100% (sirmalloc#747), Block Reset Timer hide until 100% (sirmalloc#697), fish-style branch abbreviation (sirmalloc#614), jj detached HEAD (sirmalloc#705), hooks save warning (sirmalloc#703), dev reload (sirmalloc#700), merge ends at a hidden widget (sirmalloc#698), Block Forecast and Block Limit Timer widgets (sirmalloc#699), contributor guide (sirmalloc#706), POSIX path case fix (sirmalloc#707), whitespace-distinct conflict filenames (sirmalloc#709), Quick Start reorder (sirmalloc#715), bunx launch guidance (sirmalloc#714), jj diff summary counts (sirmalloc#711), powerline manual separators (sirmalloc#713), keychain credential by account (sirmalloc#532), Keychain probe timeout (sirmalloc#760), usage cache scoped per CLAUDE_CONFIG_DIR (sirmalloc#266), test isolation (sirmalloc#717, sirmalloc#753), dev-dependency bumps (sirmalloc#745)

Conflicts resolved per the standard-resolution table; fork deletions re-applied.

Hand edits outside conflicts:
- src/utils/global-command-resolution.ts: fork-rename (ccstatusline@ -> ccstatusline-usage@ in upstream's new bunx pattern)
- src/utils/__tests__/global-package-manager.test.ts: fork-rename (package dir ccstatusline-usage in upstream's new tests)
- src/utils/usage-fetch.ts: compat fix - cacheUsageData gained a fetchedAtMs arg (upstream sirmalloc#266); adapted the fork-only fetchFreshUsageData call site
- src/utils/__tests__/usage-fetch.test.ts: compat fixes - cache/lock now hashed per CLAUDE_CONFIG_DIR (usageFilePath helper) in four fork tests; upstream fableUsage renamed to fork's weeklyFableUsage; seedUsageCache takes TokenHome
- src/utils/__tests__/usage-prefetch.test.ts: compat fix - mockFetchUsageData renamed to upstream's mockFetchUsage in cleanly-merged tests
- README.md: took upstream's Quick Start move (sirmalloc#715) and dropped the fork's old copy; fork-rename of its ccstatusline@ specifiers; links to fork-deleted docs (docs/USAGE.md, docs/WINDOWS.md) replaced with the fork's inline text
- CONTRIBUTING.md: links to the fork-deleted docs/DEVELOPMENT.md pointed at the README Development section
- docs/test-retirements.md: ledger entries for the 12 upstream test renames (sirmalloc#697, sirmalloc#698, sirmalloc#700, sirmalloc#705, sirmalloc#713, sirmalloc#760)

On macOS the usage credential lookup ran `security find-generic-password
-s "Claude Code-credentials" -w`, naming no account. Claude Code reads
and writes its login with `-a <account>` as well: $USER, the login name
when that's unset or empty, and claude-code-user for a name with
characters outside [a-zA-Z0-9._-]. A login keychain can hold more than
one item for the service. Running Claude Code as root once leaves one
under the account "root" that nothing refreshes again, and a lookup by
service alone answers with whichever item macOS finds first.

On one Mac that was root's. Its access token expired about 8 hours
after it was saved, and from then on every usage request sent that
expired token while Claude Code kept refreshing the user's own item.
The usage widgets stopped updating for about two days, until the stale
item was deleted by hand.

Each service is now looked up under that account first. Only when no
item is saved under it (exit status 44) does the lookup fall back to the
service alone, so a setup whose item sits under another account keeps
working. Any other failure of the first call still ends the keychain
lookup and backs off as before, and each profile's service name is
unchanged.

Upstream sirmalloc#532 retries the service under the OS user name only after a
service-only lookup finds no OAuth token, so a stale but well-formed item
another account left still wins there. Looking up the account first, as
here, covers its case too (an item holding only MCP tokens), so its retry
is replaced.