Clarify that only long-lived OAuth tokens (claude setup-token) or API keys should be used — short-lived tokens from the keychain expire within hours and cause recurring 401s. Also update native credential proxy skill to swap the OneCLI reference when applied. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>