Summary

v0.26.3 Homebrew/release binary fails --web OAuth login → emits:

cloud OAuth requires BKT_OAUTH_CLIENT_ID and BKT_OAUTH_CLIENT_SECRET in the environment; use --web-token for API token login

Root cause

#179 (821185b) removed cloudClientID/cloudClientSecret ldflags from .goreleaser.yaml. Public artifacts now ship empty creds → guard at pkg/cmd/auth/auth.go:321 rejects --web unless user supplies env vars.

Repro

```
brew install avivsinai/tap/bitbucket-cli # 0.26.3
bkt auth login https://bitbucket.org --kind cloud --web
```

Impact

Out-of-box --web flow no longer works. Users must:

• fall back to --web-token, or
• register own OAuth consumer + export BKT_OAUTH_CLIENT_ID/BKT_OAUTH_CLIENT_SECRET, or
• build from source with creds.

Stale docs

pkg/cmd/auth/auth.go:89-91 still says "OAuth credentials are embedded at build time via ldflags" — no longer true for public builds. README/CHANGELOG also need a note.

Proposal

Pick one:

1. Re-embed creds in public release (revert intent of fix(release): harden cloud validation and metadata #179) — restores UX.
2. Update help text + README + CHANGELOG[0.26.3] to document new flow; make --web-token the default suggestion for --kind cloud.
3. Add clear remediation in error message with link to OAuth-app registration docs.