fix: write Claude credentials file for Agent SDK auth

Agent SDK reads ~/.claude/.credentials.json, not env vars.
Write CLAUDE_CREDENTIALS_JSON org secret to disk before sync.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: 2 people

.github/workflows/upstream-sync.yml

@@ -61,6 +61,11 @@ jobs:
           npm install -g @anthropic-ai/claude-agent-sdk || npm install -g @anthropic-ai/claude-agent-sdk
           node -e "require('@anthropic-ai/claude-agent-sdk')" 2>/dev/null || echo "SDK import check: will resolve at runtime via global root"
 
+      - name: Write Claude credentials
+        run: |
+          mkdir -p ~/.claude
+          echo '${{ secrets.CLAUDE_CREDENTIALS_JSON }}' > ~/.claude/.credentials.json
+
       - name: Check for upstream changes
         id: check
         run: |