fix(claude): honor CLAUDE_CONFIG_DIR for usage

[markspen]

Human comments

What was wrong

Claude provider maintenance ignored CLAUDE_CONFIG_DIR. On macOS it always read the unsuffixed Claude Code-credentials Keychain item, while Claude Code stores custom-profile credentials under a service suffixed with the first eight SHA-256 characters of the resolved config directory. It also read credential and account files from the default profile paths. A stale default-profile token could therefore make a working custom profile appear expired or unauthenticated, as reproduced in #3607.

What changed

Provider maintenance now resolves absolute, home-relative, and home-based relative CLAUDE_CONFIG_DIR values consistently. Custom profiles use their resolved directory for .credentials.json and .claude.json, and macOS selects Claude Code-credentials-<hash>. The unsuffixed Keychain item remains a last fallback only when the custom service is absent and the custom credential file did not yield credentials. Default-profile paths and service names remain unchanged. Regression tests cover the custom Keychain service, account metadata, relative config paths, stale default credentials, and custom file precedence. There are no wire, CLI, guide, or protocol changes.

How you verified

• pnpm exec turbo run test --filter=bb-plugin-provider-claude-code --env-mode=loose (27 files, 367 tests passed)
• pnpm exec turbo run typecheck --filter=bb-plugin-provider-claude-code --env-mode=loose
• pnpm exec oxfmt --check plugins/provider-claude-code/src/bridge/provider-maintenance.ts plugins/provider-claude-code/src/bridge/provider-maintenance.credentials.test.ts
• git diff --check

Fixes #3607

AGENT GENERATED