feat: add ClaudeCodeAuthCheck for flexible agent authentication

[norrietaylor]

Replace AnthropicAPIKeyCheck with ClaudeCodeAuthCheck in CLI preflight. The new check passes if ANTHROPIC_API_KEY is set OR the claude CLI is on PATH (supporting OAuth, GitHub App, and other managed auth methods).

This allows CI environments with the Claude GitHub App installed to run agentry without requiring a separate API key.

[github-actions]

Agent run output: /home/runner/work/agentry/agentry/.agentry/runs/20260323T010946/output.json

[github-actions]

Agent run output: /home/runner/work/agentry/agentry/.agentry/runs/20260323T011350/output.json

[github-actions]

Agent run output: /home/runner/work/agentry/agentry/.agentry/runs/20260323T012846/output.json

[github-actions]

Agent run output: /home/runner/work/agentry/agentry/.agentry/runs/20260323T015738/output.json

[github-actions]

Agent run output: /home/runner/work/agentry/agentry/.agentry/runs/20260323T020105/output.json

[github-actions]

Agentry Code Review

Looking at this git diff, I can see this is a significant refactor involving authentication changes, enhanced output handling, and security improvements. Let me analyze the code for potential issues.

```json
{
  "findings": [
    {
      "file": "src/agentry/agents/claude_code.py",
      "line": 58,
      "severity": "warning",
      "category": "correctness",
      "description": "Parameter name mismatch: 'max_iterations' parameter is stored internally as '_max_turns', which could cause confusion and maintenance issues.",
      "suggestion": "Either rename the parameter to 'max_turns' or the internal field to '_max_iterations' for consistency."
    },
    {
      "file": ".github/workflows/agentry-code-review.yml",
      "line": 34,
      "severity": "warning",
      "category": "security",
      "description": "Installing global npm package without version pinning could lead to non-reproducible builds and potential supply chain attacks.",
      "suggestion": "Pin to a specific version: 'npm install -g @anthropic-ai/claude-code@^1.0.0' or use npm ci with a package-lock.json."
    },
    {
      "file": "src/agentry/agents/claude_code.py",
      "line": 218,
      "severity": "info",
      "category": "correctness",
      "description": "The output parsing logic checks for 'result_field.strip()' but this could fail if result_field is not a string, despite the isinstance check.",
      "suggestion": "The isinstance(result_field, str) check should be sufficient, but consider removing the .strip() check or add explicit string conversion for safety."
    },
    {
      "file": "src/agentry/cli.py",
      "line": 870,
      "severity": "info",
      "category": "style",
      "description": "Writing output.json before calling map_outputs is done for a specific reason (PR comments), but this architectural dependency is not clearly documented.",
      "suggestion": "Add a comment explaining why output.json must be written before map_outputs() to clarify the dependency on GitHub Actions binder behavior."
    },
    {
      "file": "src/agentry/security/checks.py",
      "line": 242,
      "severity": "info",
      "category": "correctness",
      "description": "ClaudeCodeAuthCheck checks multiple authentication methods but doesn't validate that the credentials are actually working, only that they exist.",
      "suggestion": "Consider adding a lightweight validation step (like a simple API call) to verify the credentials are not just present but functional."
    },
    {
      "file": "workflows/code-review.yaml",
      "line": 35,
      "severity": "warning",
      "category": "security",
      "description": "All workflow files now set 'trust: elevated' which reduces security restrictions. This change affects multiple workflows but lacks justification in the diff.",
      "suggestion": "Document why elevated trust is necessary and ensure this change was intentional for all workflow types, not just code review."
    }
  ],
  "summary": "This is a well

---

Tokens: 31,415 in / 2,364 out

[github-actions]

Agentry Code Review

---

Tokens: 12,762 in / 2,015 out