Make provider selection explicit; stop implicit external CLI credential reuse

[Hmbown]

Problem

Current picker source can metadata-probe a disabled external CLI credential location while presenting a "no probing" posture, and some unkeyed external rows can parse/adopt credentials on Enter without an explicit confirmation surface. Normal picker UI can leak HOME/temp credential paths, raw probe order, or state-inaccurate shortcut commands. Default UX can imply a provider is configured without usable Codewhale-owned auth.

This is TUI-UX-03/04. It is not covered by route-authority Phase 1 (#5766 / parent #5755) and must not be entangled with TUI composition (#5768/#5770/#5771).

Historical related work: #4507 (closed) required explicit consent before reading/rewriting other CLIs' credentials. Re-verify the current main/PR lineage; do not assume that closure still holds.

Required invariants

• Ordinary provider selection performs no external path check, read, refresh, network request, or consent persistence while reuse is off.
• External CLI credential reuse requires: intentional "Use external CLI credentials" choice, exact-path confirmation, then validate/read/persist only after consent.
• Revocation also needs confirmation and must clear only Codewhale-owned state.
• Default UX never claims a provider is configured without usable auth.
• Surface route readiness, model/provider, credential/billing owner, and catalog freshness only when known. Exact filesystem locations and technical diagnostics stay behind deliberate inspection.
• Antigravity/AGY may be an external helper; it must not become a Codewhale runtime provider. Legacy configuration is a clear-only, non-runnable tombstone (PRD; related fix(providers): retire Antigravity to a non-runnable tombstone with a Codewhale-owned clear path (PROD-002) #5739).

Safety while investigating

Do not read, copy, print, or persist credentials. Cite source paths and function names only.

Acceptance

• Source tests prove the ordinary picker does not inspect/adopt external CLI credentials.
• The explicit reuse flow discloses the exact path, requires confirmation, and only then validates.
• Normal UI copy has no HOME/temp credential paths or probe-order leaks.
• AGY/Antigravity is not a grantable runtime route on the current line.
• Hosted CI, runtime provider lifecycle, and billing remain separate proof lanes.
• No merge, tag, deploy, or real credential adoption without founder approval.

Out of scope

TUI composer chrome, website auth 404s, CWC account lifecycle, and 0.9.12 tagging.

[Hmbown]

Source audit (read-only, no credential files opened) of the current Tideline composition worktree, which still carries this picker behavior.

This is not covered by #5766. Keep AGY tombstone on #5739. Do not mix with #5770/#5771.

Confirmed defects

1. Ordinary picker probes while Disabled copy says it does not. ProviderDashboardRow::from_config_with_provider_id always calls resolve_credential_source. For Codex / DeepSeek / Antigravity a failed grant still runs external_grant_probe (crates/tui/src/config/credential_resolve.rs) which Path::exists() the default CLI file. Locale ProviderExternalDisabledDetail still says “no probing, reads, refresh, network, or writes.”
2. List Enter can adopt without Choice+Confirm. On unkeyed Codex/xAI, external_consent_target_is_grantable reads and parses the external file (xai_oauth::external_file_is_fresh, codex_external_file_is_fresh) then emits ProviderPickerExternalConsentConfirmed. Persist happens in handlers.rs immediately. e still opens the documented choice stage; ordinary Enter does not.
3. Default UI leaks paths and probe order. missing_auth_message concatenates checked places; Disabled rows render Owner/path: and a revoke command. Tests currently require that leak (missing_key_note_names_the_places_that_were_checked).
4. Revoke is unconfirmed (x on the list).
5. AGY is still a grantable runtime route in this lineage (ApiProvider::Antigravity in ALL, resolver grant, agy_credentials.rs). Tombstone remains fix(providers): retire Antigravity to a non-runnable tombstone with a Codewhale-owned clear path (PROD-002) #5739; this issue only needs to stop ordinary-catalog probes of that path.

Repair direction (separate PR, separate worktree)

• Stop external_grant_probe / file_exists unless a valid grant already exists.
• Delete list-Enter auto-adopt. Unkeyed Enter goes to setup/choice only.
• Do not render Disabled HOME/temp paths, probe-order Notes, or revoke shortcuts.
• Call freshness/read only after exact-path Confirm.
• Confirm-gate revoke.
• Rewrite tests that encode the current leak; add trap-file tests that must not exists/read on picker open.

No merge, no real credential adoption, no secret printing.