fix: honor explicit --config-home root for the bare-name auth store

CONFIG_ROOT layouts clear CONFIG_HOME; resolve bare names into
<root>/<agent>/ instead of silently falling back to the XDG default.
Also align docs on deva.sh invocation. Per review on #421.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: lroolle

agents/shared_auth.sh

@@ -246,9 +246,13 @@ resolve_absolute_path() {
 }
 
 # Bare credential names (no slash) live in the agent config home — the store.
+# Explicit --config-home root layouts clear CONFIG_HOME and set CONFIG_ROOT
+# (deva.sh), so honor the root before falling back to the XDG default.
 auth_store_dir() {
     if [ -n "${CONFIG_HOME:-}" ]; then
         printf '%s' "$CONFIG_HOME"
+    elif [ -n "${CONFIG_ROOT:-}" ]; then
+        printf '%s/%s' "$CONFIG_ROOT" "${ACTIVE_AGENT:-claude}"
     elif command -v default_config_home_for_agent >/dev/null 2>&1; then
         default_config_home_for_agent "${ACTIVE_AGENT:-claude}"
     else

docs/authentication.md

@@ -158,11 +158,12 @@ A bare `*.json` name (no slash) resolves against the agent config home
 (`~/.config/deva/claude/` by default) — a named credentials store:
 
 ```bash
-deva claude --auth-with claude-max.credentials.json
+deva.sh claude --auth-with claude-max.credentials.json
 # -> ~/.config/deva/claude/claude-max.credentials.json
 ```
 
 Resolution order: current directory first (compat), then the store.
+With an explicit `--config-home` root, the store is `<root>/<agent>/`.
 A missing bare name provisions into the store.
 
 #### Provisioning new credentials