docs: document Codewith auth profile preflight

[andrei-hasna]

Summary

• Add an Unreleased changelog note for hardened Codewith authProfile preflight.
• Clarify README and docs/USAGE guidance for provider-native Codewith auth profiles versus OpenAccounts.
• Document exact local/remote preflight behavior: codewith profile list parsing, active *-marked rows, exact string matching, NUL rejection, and fail-closed missing/nonzero list checks.

Validation

• git diff --check
• bun install --frozen-lockfile (with repo-local cache/temp; no lockfile changes)
• bun run typecheck
• bun test src/lib/executor.test.ts
• bun test (562 pass, 0 fail) with disposable HOME=/tmp/openloops-a7ddcd9c-home
• bun run build
• bun run test:boundary
• staged secrets scan passed
• adversarial review: no issues found; README wording tightened after reviewer residual-risk note

Task

• todos task a7ddcd9c-f7a0-42de-8452-dda8561f88ef

---

Note

Low Risk
No runtime or code changes in this diff—only user-facing documentation and changelog text.

Overview
Documentation-only PR that records and explains hardened Codewith authProfile / --auth-profile preflight (behavior described as already implemented in the agent adapter/executor).

Adds an Unreleased CHANGELOG entry under Fixed summarizing local and remote preflight: codewith profile list, acceptance of active *-marked rows, exact profile name matching, NUL-byte rejection, and fail-closed behavior when listing fails or the profile is missing.

README and docs/USAGE now distinguish Codewith --auth-profile from OpenAccounts --account, document the --auth-profile account001 example pattern, and expand Agent adapter notes and --preflight sections with the same preflight contract (including remote transport).

^{Reviewed by Cursor Bugbot for commit f98609d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[andrei-hasna]

OpenLoops worker evidence for task 5eb46ac5-ffa4-4000-8fb2-ece8c30692f6:

• PR state rechecked: OPEN, non-draft, mergeStateStatus=CLEAN, mergeable=MERGEABLE; head f98609d, base 66cea9b.
• GitHub checks are green: CI bun (ubuntu-latest), CI bun (macos-latest), Cursor Bugbot.
• Local validation on the PR head passed: bun run typecheck; bun test with sandbox-safe HOME/XDG paths (562 pass, 0 fail); bun run test:boundary; bun run build.
• Independent adversarial review found no docs-accuracy blocker.

Merge blocker: this worker is authenticated to GitHub as andrei-hasna, which is the PR author, and latestReviews/reviewDecision are empty. The routed policy selected kriptoburak as the non-author reviewer, so I did not approve or merge. Created follow-up todos task 05b3c044 for the non-author review/merge handoff.