Purpose

Integrate the fully gated managed-profile isolation work into the ruby-dlee/quota-axi default branch so Bridge cutover can install an immutable commit from the captain-controlled fork without waiting on an external maintainer.

The exact same branch head is also proposed upstream in kunchenguid/quota-axi#22.

Changes

• Scope Claude credentials, Keychain services, and access markers to one nullish/NFC-normalized CLAUDE_CONFIG_DIR, including Claude-compatible empty-value behavior.
• Read the first-party Claude OAuth profile for an authoritative root account.uuid; mark missing UUIDs unverified and never cache identity.
• Pin Codex auth inspection and the read-only app-server fallback to a fail-closed absolute QUOTA_AXI_CODEX_BINARY override.

Validation

• no-mistakes review completed after two captain-authorized isolation fixes.
• Complete Vitest suite passed under the repository-compatible Node 22 runtime.
• Generated skill check, documentation, and lint passed.
• Isolated end-to-end Claude and Codex CLI evidence passed without live provider login/logout or credential disclosure.

Pipeline

Updates from git push no-mistakes

Validated upstream contribution PR: kunchenguid#22