feat(evals): support native OMP profile authentication

[ericjuta]

Changes

• Add explicit API-key and native auth modes to the stock OMP HarnessAgent runner. API-key remains the default.
• Native mode selects an existing absolute OMP agent directory and passes the requested provider unchanged. It does not copy credentials or overwrite the selected profile's models/config files.
• Keep disposable session/child HOME, an evaluation config overlay, and canonical skill discovery in both modes. OMP owns normal writes to the selected profile, including its database.
• Migrate CLI/exported types to nested OmpAuth and document exact proof limits.

Verification

On head 13bfb4b3d3d34c50706631c520a97b81a331a279:

• Uncached vp run --no-cache verify-artifacts: 338 tests across 31 files, formatting/lint/type checks, packaged-artifact verification; 0/11 task cache hits.
• Public-boundary scan: 511 files, 12 archives, zero findings.
• Final-head push and pull-request CI, CodeQL, and dependency review passed.
• Review found and repaired a CLI ordering bug: native profile metadata is now validated before authenticated catalog traffic. The regression failed pre-fix with one intercepted request instead of zero, then passed. Built CLI smoke covered missing, relative-existing, and regular-file profiles with zero requests; valid-native and default API-key controls reached the intercepted catalog request. Scoped rereview closed the finding.
• Real stock OMP 18.1.17 against synthetic loopback providers: successful canonical skill read before MCP call in native and API-key modes, MCP-isError retained as a failed trial, missing native profile rejected before dispatch, and one physical destroy per session. Profile config/models hashes unchanged; agent.db changed as expected.

Limits

Stored API-key delegation is proven with synthetic credentials. Real OAuth refresh/subscription access and live Gina connectivity are not claimed. Gina MCP authorization remains independently required. Provider HTTP errors still become ACP assistant text plus end_turn; the direct reproduction, exact frames and retained initial retry-timeout caveat are in can1357/oh-my-pi#11644 (comment). No Docker, forks, SDK patches, or auth broker added.

The operator authorized landing this branch. No measured result publication or deployment claim is included.