Add per-service Claude credential resolver and re-login helper scripts

claude-credentials-path.ts is imported by token-refresh/claude-usage/
agent-runner-environment/runtime-inventory; committed tree already
depends on it. claude_relogin.sh is referenced by token-refresh.ts as
the manual recovery step; codex_relogin.sh mirrors the Codex re-auth
runbook. Drop stray empty .codex file.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/claude-credentials-path.ts

@@ -0,0 +1,40 @@
+import os from 'os';
+import path from 'path';
+
+function readPathEnv(key: string): string | null {
+  const value = process.env[key]?.trim();
+  return value ? path.resolve(value) : null;
+}
+
+export function getClaudeCredentialsPath(
+  accountIndex: number,
+  options: { allowHomeFallback?: boolean } = {},
+): string | null {
+  const explicitPath = readPathEnv('CLAUDE_CREDENTIALS_PATH');
+  if (accountIndex === 0 && explicitPath) return explicitPath;
+
+  const explicitAccountsDir = readPathEnv('CLAUDE_ACCOUNTS_DIR');
+  if (accountIndex > 0 && explicitAccountsDir) {
+    return path.join(
+      explicitAccountsDir,
+      String(accountIndex),
+      '.credentials.json',
+    );
+  }
+
+  if (options.allowHomeFallback === false) return null;
+
+  if (accountIndex === 0) {
+    return path.join(os.homedir(), '.claude', '.credentials.json');
+  }
+  return path.join(
+    os.homedir(),
+    '.claude-accounts',
+    String(accountIndex),
+    '.credentials.json',
+  );
+}
+
+export function hasExplicitClaudeCredentialsPath(): boolean {
+  return Boolean(readPathEnv('CLAUDE_CREDENTIALS_PATH'));
+}