feat(#493): api-key backend support (useApiKey + backendEnvironmentFile)

hive-agent/src/harness_state.rs

@@ -161,6 +161,30 @@ pub(crate) fn write_harness_state(
     write_harness_json(&v);
 }
 
+/// Stamp `api_key_mode` into the consolidated state file — a config fact
+/// (does this agent authenticate to its backend with an API key rather
+/// than a Claude OAuth session?), not runtime state, so it's written once
+/// at harness startup and never toggled again for the life of the
+/// container. Lives in the same file as the toggling fields rather than a
+/// dedicated marker file: this codebase already consolidated two ad-hoc
+/// sentinel files into one JSON for exactly the reason a new one would
+/// re-create (`hive-c0re` paying a stat call per extra file per sweep) —
+/// see this module's own doc comment above.
+///
+/// hive-c0re reads it to stop reporting `needs_login` for an agent whose
+/// `~/.claude/` dir is empty by design (`container_view::api_key_mode`) —
+/// without this, the host's own naive "does the credentials dir have
+/// files in it" check has no way to tell "never going to log in" apart
+/// from "hasn't logged in yet".
+pub(crate) fn write_api_key_mode(enabled: bool) {
+    let _guard = HARNESS_JSON_LOCK
+        .lock()
+        .unwrap_or_else(std::sync::PoisonError::into_inner);
+    let mut v = read_harness_json();
+    v["api_key_mode"] = enabled.into();
+    write_harness_json(&v);
+}
+
 /// Compiled-in fallback model used when neither `HIVE_DEFAULT_MODEL` nor a
 /// persisted runtime override is present.
 pub const DEFAULT_MODEL: &str = "haiku";