fix: restore CLIENT_ID env var and move inline import to top-level

Restore writing both CLIENT_ID and CLIENT_SECRET to .env in
createManagedOAuthCredential, matching main branch behavior.
Move dynamic import of policyEnginePrimitive to a static top-level
import per AGENTS.md conventions.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: aidandaly24

src/cli/primitives/GatewayPrimitive.ts

@@ -425,9 +425,10 @@ export class GatewayPrimitive extends BasePrimitive<AddGatewayOptions, Removable
     });
     await this.writeProjectSpec(project);
 
-    // Write client secret to .env
-    const envVarName = computeDefaultCredentialEnvVarName(credentialName);
-    await setEnvVar(envVarName, jwtConfig.clientSecret!);
+    // Write client ID and client secret to .env
+    const envVarPrefix = computeDefaultCredentialEnvVarName(credentialName);
+    await setEnvVar(`${envVarPrefix}_CLIENT_ID`, jwtConfig.clientId!);
+    await setEnvVar(`${envVarPrefix}_CLIENT_SECRET`, jwtConfig.clientSecret!);
   }
 
   /**

src/cli/tui/screens/policy/AddPolicyScreen.tsx

@@ -9,6 +9,7 @@ import { generateUniqueName } from '../../utils';
 import type { AddPolicyConfig, PolicySourceMethod } from './types';
 import { POLICY_SOURCE_METHOD_OPTIONS, POLICY_STEP_LABELS, VALIDATION_MODE_OPTIONS } from './types';
 import { useAddPolicyWizard } from './useAddPolicyWizard';
+import { policyEnginePrimitive } from '../../../primitives/registry';
 import { Box, Text } from 'ink';
 import Spinner from 'ink-spinner';
 import React, { useCallback, useEffect, useMemo, useRef, useState } from 'react';
@@ -187,7 +188,6 @@ export function AddPolicyScreen({
         const region = regionResult.region;
 
         // policyEngineId is needed; get it from deployed state
-        const { policyEnginePrimitive } = await import('../../../primitives/registry');
         const policyEngineId = await policyEnginePrimitive.getDeployedEngineId(wizard.config.engine);
 
         if (!policyEngineId) {