feat(cli): add hosted agent claim command

[Aymericr]

What does this PR do?

Adds pascal agent claim, which lets an autonomous hosted Pascal agent request its existing 15-minute claim code from the CLI and open the human claim page. The command reads PASCAL_API_KEY for that request only, deletes it from the process environment before any child process can inherit it, disables HTTP redirects, validates a bounded response, and supports --no-open and browser-free --json output.

Claiming links human accountability and lifts claim-gated capabilities. It does not transfer project ownership, grant private-project access, or upload local editor projects.

How to test

1. Run bun test packages/cli/src.
2. Run bun --filter @pascal-app/cli check-types.
3. Run bun --filter @pascal-app/cli prepublishOnly to build, stage, pack, and smoke-test the portable runtime.

Screenshots / screen recording

Not applicable; this is a terminal command.

Checklist

• I've tested this locally with bun dev
• My code follows the existing code style (targeted Biome check passed)
• I've updated relevant documentation
• This PR targets the main branch

---

Note

Medium Risk
Touches credential handling and a new authenticated hosted API path; mitigations (env stripping, response bounds, no secret reflection) are explicit but mishandling could still affect agent API keys in user environments.

Overview
Adds pascal agent claim so an autonomous hosted agent can start a short-lived claim flow from the terminal, linking the agent to a human without changing project ownership.

The CLI reads PASCAL_API_KEY once for a POST to the hosted claim endpoint, then removes it from process.env (and strips it from the browser opener’s child env) so secrets are not stored, printed, or leaked in errors. The HTTP client uses redirect: 'error', a bounded JSON body read, and strict validation of claim code, URL, and expiry; human output ignores server-controlled agent metadata. --no-open and --json support headless and scripted use. README documents the hosted-agent claim workflow and limits of claiming.

Tests cover the claim client, browser env sanitization, and end-to-end CLI behavior (help, missing key, JSON contract, error codes).

^{Reviewed by Cursor Bugbot for commit 9bed617. Bugbot is set up for automated code reviews on this repo. Configure here.}

[pascal]

I hit an error while handling your request (Model unavailable on AI Gateway free tier: Free tier users do not have access to this model. Upgrade to paid credits at https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%3Fmodal%3Dtop-up for unrestricted…).

Please try again, rephrase, or reach out if it keeps failing.

Error id: f233eac6-11b8-47c4-ab07-54e3546b476d