[JacobStephens2]

Summary

Brings #1125's Claude setup token in the Credentials to main, so it can ship in 0.14.5 without the rest of #977. #1125 merged into issue-977, which also carries an unsandboxed thirdshift experiment (#1012-#1015 are still open).

 credentials.toml
 [resend]
 key = "..."
+[claude]
+setup_token = "..."

issue-977 ── ea53fba (#1125) ──┐
                               │ cherry-pick -m 1
main ──────────────────────────┴── 0379fb1  (this PR)

Conflicts were only wording: main's plain names (#1148) against #1125's token text, in GLOSSARY.md, docs/guide.md, site/docs/index.html, site/how-it-works/index.html and src/setup.rs's expected prompts. Each keeps Ticket run and #1125's content.

Unblocks the last step of #1011: save the token through Setup on the thirdshift host.

Evidence

• Before: v0.14.4 has no claude.setup_token; git grep -il setup_token v0.14.4 -- src finds nothing, and Setup never asks for a token.
  After: Save Claude setup tokens in Credentials #1125's six tests pass on main, among them a_claude_setup_token_is_saved_with_hidden_input_even_without_notifications, malformed_credentials_never_echo_the_claude_setup_token and ordinary_runs_never_use_or_record_the_saved_claude_setup_token.
• cargo fmt --check, cargo clippy --all-targets -- -D warnings and the full cargo test passed locally: 60 of 60 test binaries ok, 0 failed.

Merge Danger

Door: two-way

When issue-977 later merges into main, git sees #1125's change on both sides; expect at most these same five files to need the same wording resolution.

Blast Radius: Setup

The strict Credentials schema also serves email commands. A credentials.toml with a [claude] section is rejected as an unknown section by 0.14.4 and earlier, so don't downgrade after saving a token.