fix(omp): clamp OMP_AUTH_BROKER_URL/TOKEN, correct the env-allowlist docs

The docs claimed omp "has no documented vendor-key namespace of its own"
and "the multi-user clamp has nothing to gate" for omp — both false. Per
omp's own docs/environment-variables.md, it reads ~40 provider keys from
env (pi's known 34-key problem in the same shape), and its own knobs are
mostly PI_* (already globally allowlisted): PI_CONFIG_DIR,
PI_CODING_AGENT_DIR, PI_CODING_AGENT_SESSION_DIR, PI_SUBPROCESS_CMD,
PI_SHELL_PREFIX. The first three also move the ~/.omp tree
omp-session-resolver.ts/omp-transcript.ts hardcode, silently degrading
pinning/history — a known gap shared with pi, documented but not fixed
here.

The OMP_* prefix this PR adds brings in OMP_AUTH_BROKER_URL/
OMP_AUTH_BROKER_TOKEN, where omp resolves credentials from — the same
shape DEEPSEEK_BASE_URL is already dropped for in
clampEnvOverridesForOwner(). Add both to OWNER_CLAMPED_ENV_KEYS so a
non-granted owner in multi-user mode can't redirect them, and correct the
false claims in CLAUDE.md, docs/omp-integration.md, and the stale
resolveOmpHome() comment. Also documents omp's default
tools.approvalMode: yolo, which was previously unstated.

src/utils/omp-session-resolver.ts

@@ -50,7 +50,13 @@ export function mangleOmpWorkingDir(workingDir: string): string {
   return relative.replace(/\//g, '-');
 }
 
-/** `~/.omp` — no known env override exists (unlike DSH_HOME); revisit if omp adds one. */
+/**
+ * `~/.omp` — omp's own env overrides are mostly `PI_*` (shared with pi mode, already
+ * allowlisted in schemas.ts), and `PI_CONFIG_DIR` in particular can move this root.
+ * That is not honored here: a session with a redirected `PI_CONFIG_DIR` silently
+ * degrades pinning/history to omp's own ambiguous `--continue` instead of erroring,
+ * a known gap (found in Ark0N/Codeman#353 review) shared with pi and not fixed here.
+ */
 function resolveOmpHome(): string {
   return join(homedir(), '.omp');
 }

src/web/routes/session-routes.ts

@@ -399,10 +399,10 @@ export const _clampExternalCliBypassForOwner = clampExternalCliBypassForOwner;
 
 /**
  * Env-var keys a non-granted owner must not be able to set, because each one
- * hands back privilege the config clamp above just removed — or, for the last,
- * redirects a credential the server injects.
+ * hands back privilege the config clamp above just removed, or redirects a
+ * credential-resolution endpoint.
  *
- * All are DeepSeek's, and all are reachable because `DSH_*` and `DEEPSEEK_*` are
+ * The DeepSeek three are reachable because `DSH_*` and `DEEPSEEK_*` are
  * allowlisted `envOverrides` prefixes (schemas.ts) — which they have to be, since
  * that is also how a user configures the harness's non-privileged knobs.
  *
@@ -419,8 +419,24 @@ export const _clampExternalCliBypassForOwner = clampExternalCliBypassForOwner;
  *   URL would have the operator's API key sent as a bearer credential to a host
  *   of their choosing. (`DEEPSEEK_API_KEY` itself stays overridable: supplying
  *   your OWN key removes privilege rather than granting it.)
+ * - `OMP_AUTH_BROKER_URL`/`OMP_AUTH_BROKER_TOKEN` are where omp resolves
+ *   credentials from — the same shape as `DEEPSEEK_BASE_URL` above, reachable
+ *   because `OMP_*` is an allowlisted prefix. Unlike DeepSeek, Codeman does not
+ *   forward any operator-held key into an omp pane today (omp's provider
+ *   credentials live in `~/.omp` config files, not env vars), so there is no
+ *   known concrete exfiltration path yet — clamped defensively anyway, since a
+ *   non-granted owner redirecting where a shared multi-tenant deployment
+ *   resolves auth from is not something to allow silently (found in
+ *   Ark0N/Codeman#353 review; omp's own knobs are otherwise mostly `PI_*`,
+ *   already allowlisted for pi and not addressed here — see resolveOmpHome()).
  */
-const OWNER_CLAMPED_ENV_KEYS = ['DSH_PERMISSION_MODE', 'DSH_HOME', 'DEEPSEEK_BASE_URL'] as const;
+const OWNER_CLAMPED_ENV_KEYS = [
+  'DSH_PERMISSION_MODE',
+  'DSH_HOME',
+  'DEEPSEEK_BASE_URL',
+  'OMP_AUTH_BROKER_URL',
+  'OMP_AUTH_BROKER_TOKEN',
+] as const;
 
 /**
  * Env-var half of the multi-user bypass clamp.