Fix agentd buffet provider support (claude-code, codex)

agentd containers fail with CostExhausted immediately when using OpenRouter (account out of credits) and the claude-code provider doesn't exist inside the container's agent binary.

Root causes found during Pipeline testing (t-603): 1. OpenRouter returns 402 (insufficient credits), agent translates this to CostExhausted 2. The agent binary inside Docker containers only supports: anthropic, openrouter, ollama — no claude-code/codex 3. ANTHROPIC_API_KEY is not set in the host env (only OPENROUTER_API_KEY), so --provider anthropic also fails inside containers 4. Auth token for claude-code may just need refreshing

Fix options:

• Add claude-code/codex provider support to the container agent binary
• Pass through OAuth tokens / refresh mechanism into containers
• Ensure ANTHROPIC_API_KEY or equivalent auth is available
• Consider adding a --provider passthrough that uses host-side pi via RPC instead of container-local inference

The agentd daemon mode (Omni/Agentd/Daemon.hs) already uses pi via RPC — the CLI agentd run path needs the same capability.

Key files:

• Omni/Agentd.hs (runAgent function, ~line 847)
• Container agent binary (inside agent-git/agent-haskell images)
• Omni/Agentd/Daemon.hs (spawnPiAgent — working reference)