chore: automate OAuth token rotation via secrets-sync

[JacobPEvans]

Summary

Claude Code OAuth tokens expire periodically. Currently, renewal requires manually running claude setup-token, then updating both CLAUDE_CODE_OAUTH_TOKEN and ANTHROPIC_API_KEY secrets in the secrets-sync repo, then triggering the sync workflow.

Automate this process so token rotation is a single command or scheduled workflow.

Current Process

1. Run claude setup-token locally to get new OAuth token
2. gh secret set CLAUDE_CODE_OAUTH_TOKEN --repo JacobPEvans/secrets-sync
3. gh secret set ANTHROPIC_API_KEY --repo JacobPEvans/secrets-sync
4. Trigger secrets-sync workflow to distribute to all repos

Desired State

• Single command or workflow that handles the full rotation
• Optionally: scheduled check that warns when token is near expiry

Phase

Backlog