setup: drop redundant agent ping; harden auth detection and OAuth paste

- verify: remove the CLI ping; cli-agent step earlier in setup already
  proved the round-trip works, and the test agent gets cleaned up before
  verify runs — so the ping was guaranteed to fail on installs that wired
  a messaging app instead of staying CLI-only. Status now collapses to
  service-running ∧ credentials ∧ ≥1 wired group.
- agent-ping: catch Claude Code's "Please run /login" / "Not logged in" /
  "Invalid API key" banners so a successfully-spawned agent that has no
  credentials no longer reports as 'ok'.
- auth paste: validate the full sk-ant-oat…AA shape; when the cleaned
  input is under 90 chars, surface a truncation-specific hint pointing at
  terminal wrap as the likely cause. Strip internal whitespace at both
  validate and assignment so multi-line pastes that survive clack also
  go through cleanly.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

setup/verify.test.ts

@@ -5,45 +5,14 @@ import { determineVerifyStatus } from './verify.js';
 const healthyBase = {
   service: 'running' as const,
   credentials: 'configured',
-  anyChannelConfigured: false,
   registeredGroups: 1,
-  agentPing: 'ok' as const,
 };
 
 describe('determineVerifyStatus', () => {
-  it('accepts a working CLI-only install', () => {
+  it('accepts a healthy install with at least one wired agent group', () => {
     expect(determineVerifyStatus(healthyBase)).toBe('success');
   });
 
-  it('accepts a messaging-channel install when CLI ping is skipped', () => {
-    expect(
-      determineVerifyStatus({
-        ...healthyBase,
-        anyChannelConfigured: true,
-        agentPing: 'skipped',
-      }),
-    ).toBe('success');
-  });
-
-  it('fails when neither CLI nor messaging channels are usable', () => {
-    expect(
-      determineVerifyStatus({
-        ...healthyBase,
-        agentPing: 'skipped',
-      }),
-    ).toBe('failed');
-  });
-
-  it('fails when the CLI agent does not respond', () => {
-    expect(
-      determineVerifyStatus({
-        ...healthyBase,
-        anyChannelConfigured: true,
-        agentPing: 'no_reply',
-      }),
-    ).toBe('failed');
-  });
-
   it('fails when no agent groups are registered', () => {
     expect(
       determineVerifyStatus({
@@ -52,4 +21,22 @@ describe('determineVerifyStatus', () => {
       }),
     ).toBe('failed');
   });
+
+  it('fails when the service is not running', () => {
+    expect(
+      determineVerifyStatus({
+        ...healthyBase,
+        service: 'stopped',
+      }),
+    ).toBe('failed');
+  });
+
+  it('fails when credentials are missing', () => {
+    expect(
+      determineVerifyStatus({
+        ...healthyBase,
+        credentials: 'missing',
+      }),
+    ).toBe('failed');
+  });
 });