feat(custom-model): skip Claude Code's first-run wizard on custom-model launches

A fresh, isolated CLAUDE_CONFIG_DIR (used to keep an injected API key
away from a stored claude.ai OAuth login) looks like a brand-new Claude
Code profile to the CLI, so it replays its ENTIRE first-run sequence on
every single launch: the theme picker, the security-notes screen, the
per-project "trust this folder?" dialog, and (running with
--dangerously-skip-permissions) a one-time bypass-permissions warning —
confirmed live, none of which a real, already-onboarded profile shows
again.

- New registry-declared env-kind field `skipFirstRunPrompts` (alongside
  apiKeyTrustFile, which it reuses) — claude's entry only, carried
  through buildCustomModelInjection (pure) into
  applyCustomModelInjection (IO).
- seedFirstRunOnboardingState(): merges hasCompletedOnboarding: true and
  this session's own projects[workingDir].hasTrustDialogAccepted: true
  into the same <configDir>/.claude.json the API-key trust file already
  writes to — other projects and other fields on this session's own
  entry are left untouched.
- seedSkipBypassPermissionsPrompt(): merges
  skipDangerousModePermissionPrompt: true into <configDir>/settings.json,
  a separate file, same corrupt-tolerant merge behavior.
- applyCustomModelInjection() gains an optional workingDir parameter,
  threaded from session.workingDir (dedicated apply route) /
  resolvedCasePath (quick-start route) — boot recovery omits it
  (a dialog already answered once needs no re-seed on the same,
  persisted isolated directory).

Tests added at the pure-builder, IO-wrapper (including merge-preserves-
other-fields and corrupt-file-tolerance cases), and existing directory-
listing assertions updated for the new settings.json file. Typecheck/
lint/format clean; full suite shows no new regressions (baseline
pre-existing Windows-environment failures unchanged, 8 more passing
tests than before — the ones added here).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RqZeHrRS6DYcGcGX2p9EwG

docs/custom-model-endpoints.md

@@ -285,6 +285,27 @@ earlier launch in the same isolated directory (`userID`, `numStartups`,
 earlier approved keys), and a missing or corrupt file is treated as empty
 rather than failing the apply.
 
+**A fresh `CLAUDE_CONFIG_DIR` isn't just missing that one approval — Claude
+Code treats it as a brand-new profile and replays its ENTIRE first-run
+sequence on every launch: the theme picker, the security-notes screen, the
+per-project "trust this folder?" dialog, and (running with
+`--dangerously-skip-permissions`) a one-time warning about bypassing
+permissions.** Confirmed live: none of these show up again for a real,
+already-onboarded profile, but every custom-model session gets a fresh,
+otherwise-empty isolated directory, so it saw all four every single time.
+`customModelInjection`'s `skipFirstRunPrompts` (`true` on claude's entry,
+requires `apiKeyTrustFile` since it reuses the same file) pre-seeds the
+state a real profile accumulates from answering all of that once:
+`hasCompletedOnboarding: true` and the launching session's own
+`projects[workingDir].hasTrustDialogAccepted: true` go into the same
+`<configDir>/.claude.json` the API-key approval above already merges into
+(other projects, and other fields on this session's own project entry, are
+left untouched), and `skipDangerousModePermissionPrompt: true` goes into
+`<configDir>/settings.json` — a different file, merged the same
+corrupt-tolerant way. `workingDir` is used exactly as the session was
+launched with as its cwd, never realpath'd or slash-normalized, since
+that's the literal string Claude Code itself uses as the project key.
+
 **llama-swap gets two more fixes on top of the context-length/config-dir
 ones above, both from watching a real switch live.** llama.cpp only ever
 runs one model at a time; llama-swap swaps the backing process on demand,

docs/wiki/Custom-Model-Endpoints.md

@@ -89,7 +89,7 @@ error telling you to check the llama-swap server's own logs, and **the session t
 for is closed automatically** — a console left open and pointed at a model that never
 finished loading would just be confusing to leave sitting there.
 
-**Claude Code specifically gets two extra fixes applied automatically:**
+**Claude Code specifically gets three extra fixes applied automatically:**
 
 - Its discovered context length (see above) is passed through as
   `CLAUDE_CODE_MAX_CONTEXT_TOKENS`, so it doesn't send a full-size prompt against a much
@@ -103,6 +103,14 @@ finished loading would just be confusing to leave sitting there.
   own, so Codeman also pre-approves the injected key the same way answering Claude Code's own
   "Detected a custom API key" prompt once would — without it, that prompt would otherwise
   reappear on every single launch with nobody there to answer it.
+- **That same fresh isolated directory also looks like a brand-new Claude Code profile**, so
+  without this fix it replayed the WHOLE first-run sequence every single launch: the theme
+  picker, the security-notes screen, the "trust this folder?" dialog, and a one-time warning
+  about running with permissions bypassed — none of which a real, already-used profile shows
+  again. Codeman now pre-seeds that same "already been through this once" state (onboarding
+  completed, this session's own project marked trusted, the bypass-permissions warning
+  acknowledged) so a custom-model launch reaches the actual conversation exactly as fast as a
+  native cloud one does, instead of stopping at a wizard with nobody there to click through it.
 
 **If a model's real context is too small for Claude Code to even get started, you get a
 warning instead of a confusing failure.** Claude Code's own system prompt and tools take up