ci: rename Claude OAuth secret to CC_OAUTH_TOKEN

Same OAuth token, new secret name. The previous name CLAUDE_CODE_OAUTH_TOKEN
collides with the env var that Claude Code itself recognizes as a
credential, so any process in the pipeline that touches its own login
state (the action child claude process, the runner-side claude install,
or developer-machine tooling) can clobber, mask, or otherwise interact
with that env. Renaming the GitHub Actions secret to CC_OAUTH_TOKEN
avoids the magic-name interaction; the action input name
(claude_code_oauth_token) is unchanged.

Symptom: same workflow, same action SHA (v1.0.108 = 11a9dadd), same
agent SDK (0.2.121), unchanged secret value produced 6 consecutive
successful @claude runs (15:27-15:55 UTC) and then 4 consecutive
failures (16:00-16:13 UTC) on 2026-04-28, all with SDK error "Could
not resolve [authentication]" thrown from validateHeaders. Workflow
variables are exhausted, so the remaining moving parts are the secret
name itself and the OAuth token behind it. The secret has been
re-registered under CC_OAUTH_TOKEN with a fresh token; this commit
only flips the workflow reference.

Author: bootjp

.github/workflows/claude.yml

@@ -34,7 +34,7 @@ jobs:
         id: claude
         uses: anthropics/claude-code-action@v1
         with:
-          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          claude_code_oauth_token: ${{ secrets.CC_OAUTH_TOKEN }}
 
           # This is an optional setting that allows Claude to read CI results on PRs
           additional_permissions: |