feat(config): split OAuth vs API-key in models[] registry (plugin-dev-agent)

Claude Code supports two auth paths that use different env vars:
- OAuth (via `claude login`) → CLAUDE_CODE_OAUTH_TOKEN, tied to a
  Claude Code subscription
- Direct API key → ANTHROPIC_API_KEY, pay-as-you-go via the Anthropic
  Console

Previously the template only listed CLAUDE_CODE_OAUTH_TOKEN, hiding the
API-key path and forcing API-key users to override manually. Now
models[] exposes both as distinct dropdown entries — users pick the
one matching the credential they have; canvas auto-suggests the right
env var.

Model IDs differ intentionally:
- OAuth entries use CLI aliases (sonnet/opus/haiku — resolve to latest)
- API-key entries use explicit versioned ids (claude-sonnet-4-6, etc.)

claude CLI accepts either auth style transparently — OAuth wins when
both are set, which preserves existing workspace behaviour.

Paired with Molecule-AI/molecule-core#1526 (platform + canvas).

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

config.yaml

@@ -1,13 +1,54 @@
 name: Claude Code Agent
-description: General-purpose Claude Code workspace
+description: >-
+  General-purpose Claude Code workspace. Supports two auth paths:
+  (1) Claude Code subscription via OAuth token (CLAUDE_CODE_OAUTH_TOKEN,
+  obtained from `claude login`), or (2) Anthropic API key
+  (ANTHROPIC_API_KEY, pay-as-you-go via console.anthropic.com). The
+  `claude` CLI picks whichever is set; OAuth takes precedence when both
+  are present.
 version: 1.0.0
 tier: 2
 
 runtime: claude-code
 runtime_config:
   model: sonnet
+
+  # Canvas surfaces this list as a Model dropdown and auto-populates
+  # Required Env Vars based on the selected entry. OAuth and API-key
+  # variants of each model appear as separate entries so users pick
+  # the auth path matching the key they have — the claude CLI accepts
+  # either and the model id is identical across both.
+  models:
+    # --- OAuth (Claude Code subscription) — set CLAUDE_CODE_OAUTH_TOKEN ---
+    - id: sonnet
+      name: Claude Sonnet (OAuth / Claude Code subscription)
+      required_env: [CLAUDE_CODE_OAUTH_TOKEN]
+    - id: opus
+      name: Claude Opus (OAuth / Claude Code subscription)
+      required_env: [CLAUDE_CODE_OAUTH_TOKEN]
+    - id: haiku
+      name: Claude Haiku (OAuth / Claude Code subscription)
+      required_env: [CLAUDE_CODE_OAUTH_TOKEN]
+
+    # --- Direct Anthropic API — set ANTHROPIC_API_KEY ---
+    # Explicit versioned ids so the API call lands on a specific snapshot
+    # (OAuth aliases above resolve to the latest each model family).
+    - id: claude-sonnet-4-6
+      name: Claude Sonnet 4.6 (API key / Anthropic Console)
+      required_env: [ANTHROPIC_API_KEY]
+    - id: claude-opus-4-7
+      name: Claude Opus 4.7 (API key / Anthropic Console)
+      required_env: [ANTHROPIC_API_KEY]
+    - id: claude-haiku-4-5
+      name: Claude Haiku 4.5 (API key / Anthropic Console)
+      required_env: [ANTHROPIC_API_KEY]
+
+  # Default required_env — per-model entries above override this once a
+  # model is picked. Keep CLAUDE_CODE_OAUTH_TOKEN as the default so
+  # existing workspaces (which all use OAuth) keep working unchanged.
   required_env:
     - CLAUDE_CODE_OAUTH_TOKEN
+
   timeout: 0
 
 template_schema_version: 1