Summary

Closes #2338.

Deletes the entire src/commands/onboard-auth.* cluster — 13 files, ~3,500 LoC — plus 2 cascade files, totaling 15 files and 3,765 deletions. The cluster was a parallel credential-management layer with zero production callers. The live onboarding wizard (src/wizard/onboarding.ts) writes credentials directly via upsertAuthProfile in src/agents/auth-profiles.ts and never touches any of these files.

Deletions

Primary cluster (13 files, per issue body):

• src/commands/onboard-auth.ts (barrel)
• src/commands/onboard-auth.config-core.ts
• src/commands/onboard-auth.config-core.kilocode.test.ts
• src/commands/onboard-auth.config-gateways.ts
• src/commands/onboard-auth.config-litellm.ts
• src/commands/onboard-auth.config-minimax.ts
• src/commands/onboard-auth.config-opencode.ts
• src/commands/onboard-auth.config-shared.ts
• src/commands/onboard-auth.config-shared.test.ts
• src/commands/onboard-auth.credentials.ts
• src/commands/onboard-auth.models.ts
• src/commands/onboard-auth.test.ts
• src/commands/onboard-non-interactive.provider-auth.test.ts

Cascade (2 files, flagged as "Cascades Unlocked" in the issue):

• src/commands/zai-endpoint-detect.ts — imports 4 ZAI_*_BASE_URL constants from the deleted onboard-auth.models.ts; zero production callers (only its own test)
• src/commands/zai-endpoint-detect.test.ts

Verification

• git grep \"onboard-auth\" src/ → 0 hits
• git grep \"from.*commands/onboard-auth\" src/ → 0 hits
• git grep \"zai-endpoint-detect\" src/ → 0 hits
• pnpm check (format + tsgo + lint) → clean
• pnpm test → 725 files, 6341 passed, 2 skipped, 0 failures

A fresh-context adversarial review dispatched as a workflow-polish subprocess independently verified symbol-level grep for every export (writeOAuthCredentials, applyOnboardAuthAgentModelsAndProviders, all 20 apply*Config functions, all 22 set*ApiKey setters, build*ModelDefinition helpers, detectZaiEndpoint, resolveZaiBaseUrl) — all zero hits. The live onboarding path via src/wizard/onboarding.ts was confirmed to reach upsertAuthProfile without touching any deleted file.

Sibling Coordination

• gut: re-apply provider/model cascade after v2026.3.7 sync regression (~19 files) #2337 (parallel): owns the Pi-era provider-stub cascade files in src/agents/{huggingface,synthetic,together,venice}-models.ts, src/agents/models-config.providers.ts, and src/secrets/provider-env-vars.ts. This PR does not touch any of them — they become orphaned here and will be swept there.
• fix(onboard): remove 21 dead provider auth flags and add missing --codex-api-key #2341 (parallel): owns onboard-provider-auth-flags.ts. Not touched here.

Out of Scope

• Manual remoteclaw onboard wizard smoke test (from issue AC) — recommended to run manually before merge, though no middleware code is touched so LIVE=1 pnpm test:live is not required by the project CI gate.

Test Plan

• pnpm install
• pnpm canvas:a2ui:bundle
• pnpm check (format + tsgo + lint)
• pnpm test
• Grep assertions from issue AC
• CI: build, test, lint, docs (will run on push)
• CI: zombie-import gate (Add CI zombie-import gate: detect imports from gutted modules #2195)
• Manual: remoteclaw onboard wizard end-to-end (recommended pre-merge)