fix(custom-model): pre-approve the injected API key in the isolated Claude config dir

The CLAUDE_CONFIG_DIR isolation from the previous commit fixed the cosmetic
auth warning but introduced a real regression: an otherwise-empty config
directory has none of a real profile's prior custom-API-key approvals, so
Claude Code stops at an interactive 'Detected a custom API key - use it?'
prompt on every single launch. Confirmed live. With nobody at a TTY to
answer, the prompt's own default ('No') silently refuses the very key this
feature just injected, which looks like the endpoint being ignored.

Adds apiKeyTrustFile to the env-kind customModelInjection capability shape
({relPath, shape: 'claude-api-key-responses'}), set on claude's entry to
{relPath: '.claude.json', shape: 'claude-api-key-responses'}. The apply step
merges customApiKeyResponses.approved: [apiKey] into
<isolatedConfigDir>/.claude.json - the exact field a real answered prompt
itself writes to (confirmed against a real ~/.claude.json after answering by
hand once), so this answers the prompt in advance rather than bypassing it.
Merges onto whatever the CLI already wrote into that file on an earlier
launch in the same isolated directory rather than overwriting it; a missing
or corrupt file is treated as empty rather than failing the apply.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RqZeHrRS6DYcGcGX2p9EwG

src/config/cli-registry/schema.ts

@@ -347,6 +347,17 @@ const capabilitiesSchema = z
           // session. See the customModelInjection doc comment in cli-registry/types.ts.
           contextLengthVar: envName.optional(),
           configDirVar: envName.optional(),
+          // Relative path, WITHIN the isolated configDirVar directory, of a trust-dialog
+          // seed file the CLI itself owns the shape of — claude's `.claude.json`
+          // `customApiKeyResponses.approved` list, the same field an interactive "Detected
+          // a custom API key — use it?" prompt writes to on a real terminal. Only makes
+          // sense alongside configDirVar (an isolated, otherwise-empty directory has none
+          // of a real profile's prior approvals), and only implemented for the
+          // 'claude-api-key-responses' shape today — see custom-model-injection-apply.ts.
+          apiKeyTrustFile: z
+            .object({ relPath: z.string().min(1).max(80), shape: z.literal('claude-api-key-responses') })
+            .strict()
+            .optional(),
         })
         .strict(),
       z