pr-visual-recap-reusable: support Claude Code subscription auth (CLAUDE_CODE_OAUTH_TOKEN) alongside ANTHROPIC_API_KEY

[busbyk]

Problem

We consume .github/workflows/pr-visual-recap-reusable.yml@main from a consumer repo (NWACus/web) and would like to run the Claude backend on a Claude subscription via a Claude Code OAuth token, rather than a token-usage-billed API key. Subscription auth for CI is documented by Anthropic (Claude Code GitHub Actions docs): Pro/Max/Team/Enterprise subscribers run claude setup-token locally to mint a long-lived CLAUDE_CODE_OAUTH_TOKEN, and the Claude Code CLI the workflow already shells out to (npx -y @anthropic-ai/claude-code@2) honors that env var.

The reusable workflow currently can't receive it:

• The workflow_call secrets contract only declares ANTHROPIC_API_KEY, and per GitHub's reusable-workflows docs, a called workflow can only use secrets explicitly declared in and passed through that contract.
• The gate's presence check (HAS_ANTHROPIC, L154) skips the run for the claude backend when that secret is empty (L233).
• The Claude Code invocation steps only pass ANTHROPIC_API_KEY into the CLI's env (L590, L757).

Request

Add an optional CLAUDE_CODE_OAUTH_TOKEN secret and treat it as an alternative credential for the claude backend:

1. Declare CLAUDE_CODE_OAUTH_TOKEN (required: false) in on.workflow_call.secrets.
2. In the gate, add a presence-only signal for it and change the claude-backend check to require either secret.
3. Pass CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} in the env of both Claude Code invocation steps.
4. Docs: note that consumers should set exactly one of the two — Anthropic's action setup docs treat the API key and the OAuth token as separate, mutually exclusive auth paths, so setting both makes the billing path ambiguous.

The installer templates in @agent-native/recap-cli (recap setup, recap doctor, PR_VISUAL_RECAP_SETUP) would ideally learn about the alternative too, but the reusable workflow change alone unblocks callers.

Alternatives considered

Vendoring the full workflow copy into our repo and patching it — works, but loses the auto-updating @main reference, which is the main reason we chose the reusable variant.