Headless `run` is unusable outside a configured HOME: silent hangs, exit-code 0 on fatal errors, provider env split-brains

PR #1092 の eval harness から始め、コンパイル済みの run CLI を通じて、文書化されている環境変数のみの実行を再現し、OPTIMIZER_EVAL_TRANSCRIPT を取得します。provider.ts:629 とエラーおよびストリーム終了のパスを調査し、その後 bun test を使って、致命的なエラーが nonzero を返すこと、プロセスが終了すること、ストリームが完了または失敗すること、文書化されている provider 変数が一貫して機能することを確認します。

Found while running the dbt-optimizer live eval (PR #1092) — the eval spawns the compiled binary in an isolated HOME with env-only model credentials, which is exactly the headless/CI posture. Eight runs produced six distinct product defects before a single model call succeeded:

1. run exits 0 on fatal errors. Error: Token refresh failed: 400 and Model not found: ... both print to the transcript and exit 0. Headless consumers cannot detect failure by exit code.
2. Errored CLI lingers as a dangling process. After a provider-lookup error, the process survived spawnSync timeout (SIGTERM and SIGKILL configured) — observed alive ~2h and ~69m in two runs until bun test force-killed it.
3. Silent stream hang on google-vertex-anthropic. With valid ADC (verified via gcloud auth application-default print-access-token), the session starts, the title-agent call is issued... and nothing ever arrives — no error, no timeout, no finish. Logs end at session.updated.
4. Google provider env split-brain. Provider detection accepts GEMINI_API_KEY, but the SDK call then demands GOOGLE_GENERATIVE_AI_API_KEY — detection succeeds, invocation fails.
5. Vertex provider env split-brain. The models.dev env list advertises GOOGLE_VERTEX_PROJECT/GOOGLE_VERTEX_LOCATION, but the loader (provider.ts:629) only detects via GOOGLE_CLOUD_PROJECT/GCP_PROJECT/GCLOUD_PROJECT; GOOGLE_VERTEX_PROJECT is an output var only. Env-only vertex configuration per the documented names cannot work.
6. OAuth auth store is location-bound. Copying auth.json to a new HOME yields Token refresh failed: 400 (refresh-token rotation), so OAuth accounts have no headless path at all; and per (1) that failure is invisible to exit-code checks.

Repro for each is in the PR #1092 eval harness: OPTIMIZER_LIVE_EVAL=1 + OPENCODE_TEST_CLI + the documented env vars; transcripts captured via OPTIMIZER_EVAL_TRANSCRIPT.

Suggested severity: (1) and (3) first — they make headless usage silently unreliable; (4)/(5) are one-line env additions; (2) needs a process-exit audit on the error path; (6) needs a documented headless auth story (API-key path or device-flow re-auth).