4f0e466e5d
The salvaged carve-out covered the PKCE file and Claude Code credentials but missed the canonical wired-token location — auth.json credential_pool.anthropic oauth entries. Discovery accepts those via pool.has_credentials(), so the filter must too. Read-only dict access; api_key pool entries intentionally stay excluded (E2E case 4).