Summary

• Reduces ONBOARD_PROVIDER_AUTH_FLAGS from 23 entries to the 4 runtimes RemoteClaw actually consumes: anthropic, openai, gemini, codex (newly wired).
• Drops the matching 20 dead *ApiKey fields from OnboardOptions and their forwarders in register.onboard.ts. The non-interactive inference path (applyNonInteractiveAuthChoice / inferAuthChoiceFromFlags) has been a gutted no-op since the fork split, so every dropped flag was already silently discarded.
• Fixes non-interactive Codex onboarding. src/wizard/onboarding.ts:181 has always read opts.codexApiKey, but no --codex-api-key flag was ever registered — so scripted Codex setup hit unknown option errors. The wizard side needed no change; the fix is purely plumbing.

Changes

Net: 17 insertions, 208 deletions.

Acceptance Criteria

• `ONBOARD_PROVIDER_AUTH_FLAGS` contains exactly 4 entries: `anthropic`, `openai`, `gemini`, `codex`
• `OnboardOptions` contains exactly 4 `*ApiKey` fields matching the above
• `register.onboard.ts` forwards exactly 4 provider-auth flags
• `remoteclaw onboard --help` shows only the 4 live flags (probed via commander `options` inspection)
• New test: `--codex-api-key ` forwards as `opts.codexApiKey` — wizard already consumes it at `src/wizard/onboarding.ts:181`
• `pnpm check` passes (format + tsgo + lint)
• Targeted `pnpm vitest run` green: `register.onboard.test.ts` 7/7, `wizard/onboarding.test.ts` 7/7

Scope Coordination

This PR is independent of #2338 (onboard-auth cluster gut) running in parallel. Per the issue body and CALLER CONTEXT, I explicitly left these alone:

• `src/commands/onboard-non-interactive.provider-auth.test.ts` — owned by gut: delete dead onboard-auth.* cluster (13 files, ~2,500 LoC orphaned credential layer) #2338 (full deletion). Its `Record<string, unknown>` test helpers shield it from the `OnboardOptions` field removals here, so `pnpm check` remains green without modifications.
• `src/commands/onboard-auth.*` files — owned by gut: delete dead onboard-auth.* cluster (13 files, ~2,500 LoC orphaned credential layer) #2338. Pre-existing test failures there (verified by running on clean `main` with my changes stashed) are not regressions introduced by this PR.
• `cloudflareAiGatewayAccountId` / `cloudflareAiGatewayGatewayId` kept in `OnboardOptions` — they are not `*ApiKey` fields and therefore out of this issue's AC scope. They become functionally dead once `cloudflareAiGatewayApiKey` is gone; worth a follow-up cleanup PR after gut: delete dead onboard-auth.* cluster (13 files, ~2,500 LoC orphaned credential layer) #2338 lands.

Test plan

• `pnpm check` passes locally
• `pnpm vitest run src/cli/program/register.onboard.test.ts src/wizard/onboarding.test.ts` — 14/14 pass
• Commander probe: `onboard` command registers exactly 4 provider-auth flags (`--anthropic-api-key`, `--openai-api-key`, `--gemini-api-key`, `--codex-api-key`). The unrelated `--custom-api-key` (custom provider config) remains as expected.
• CI build + test (GitHub Actions)
• Manual smoke test deferred to post-merge (requires gateway + TTY setup not available in this environment)

Closes #2341

🤖 Generated with Claude Code