Harden the OAuth-only launcher boundary

[ItayCohen-Prog]

What changed

• Remove ambient OpenAI and Anthropic API-billing credentials from the gptCode launcher before auth resolution or child-process startup.
• Preserve the Codex OAuth credential path (CODEX_HOME and Codex OAuth access).
• Extend launcher regression coverage and clarify the public README guarantee.

Why

The model path was already Codex OAuth-only and the Claude child was already isolated, but the outer launcher could still inherit unused ambient API-key variables. Removing them at process entry makes the boundary explicit across the launcher, local proxy, and Claude child.

Validation

• npm test - 102/102 passed
• npm pack --dry-run - 20 files, package 1.1.1
• git diff --check
• Live Windows process-environment audit: OPENAI_API_KEY absent from the gptCode outer Node, loopback proxy, and Claude child; stock Claude remained untouched
• Live resumed Tessera session reports GPT-5.6 Sol, high effort, and Codex OAuth