fix: AI reviewer authenticated via low-balance API key instead of subscription

[lsfera]

Summary

Investigating why PR #92's and PR #96's AI reviews both failed with changes-requested fail-safe verdicts turned up a real, previously-misdiagnosed root cause.

Both review logs show the same fatal line:

Credit balance is too low
Agent invocation failed: claude-code exited with code 1:
Ignoring 64 permissions.allow entries from .claude/settings.local.json: this workspace has not been trusted...

The "workspace not trusted" line is a harmless warning that always prints — it's not what killed the process. "Credit balance is too low" is the actual failure.

Root cause: reviewer-adapter.ts runs via noSandbox() + sandcastle's top-level run(), which inherits the devcontainer's own process env. That env carries ANTHROPIC_API_KEY (ADR-0018 cockpit passthrough; also needed by headroom's own compress() calls, ADR-0023) alongside CLAUDE_CODE_OAUTH_TOKEN (resolved separately from .sandcastle/.env by sandcastle for agent auth). Claude Code prefers an explicit API key over the subscription token whenever both are present — so every review silently authenticated against the API key, and failed outright once that key's balance ran out.

Verified precisely: ANTHROPIC_API_KEY="" CLAUDE_CODE_OAUTH_TOKEN=<real> claude --print ... succeeds where the unmodified env fails. Also confirmed the fix mechanism itself works on this specific code path (sandcastle's top-level run() does correctly merge AgentProvider.env — unlike SandboxRunner's createSandbox() + .run() path fixed in #97, where it's silently discarded).

Fix: force ANTHROPIC_API_KEY to an empty string (not omitted — Claude Code only falls back to OAuth when the var is unset/empty) on all 4 claudeCode() calls in reviewer-adapter.ts, via a shared FORCE_OAUTH_ENV constant.

Test plan

• npm test — 206/206 passing
• tsc --noEmit — clean
• Live-verified via sandcastle's actual run() API (same one reviewer-adapter.ts uses): a claudeCode(model, { env: { ANTHROPIC_API_KEY: "" } }) call against a real noSandbox() invocation succeeded using the subscription token