Rename setups and add provider reauthentication

.claude/skills/ai-app-rigs/SKILL.md

@@ -72,13 +72,15 @@ Each exists because something was invisible without it.
   `usage::Fixture`'s, since those are its states. With none set an echo
   session meters nothing, which is the ordinary case and draws no bar.
 - **A fake CLI exercises the process lifecycle without a token.** Point a
-  `claude_cli` provider's `command` at a two-line script — `#!/bin/sh` and
-  `cat > /dev/null` — and it behaves the way the lifecycle code cares about:
+  `claude_cli` provider's `command` at a script that ordinarily runs
+  `cat > /dev/null` and it behaves the way the lifecycle code cares about:
   it holds the fifo open, records a real pid, writes nothing, and dies on a
   signal. So adopt, stop, restart and start are all drivable without a real
   `--resume` and without spending a turn on somebody's account. Reach for
   this when what is under test is *whether a process is running*, and for
-  `debug-transcript.sh` when it is *what the transcript draws*.
+  `debug-transcript.sh` when it is *what the transcript draws*. The sandbox's
+  version also handles `auth login`: it prints an inert Anthropic-shaped URL,
+  rejects any code except `sandbox-code`, and exits successfully for that one.
 - **`app/transcript-bench.sh`** is the standard scroll measurement: it opens
   the first session (or `-k` keeps the current screen), scrolls a fixed
   gesture loop, and prints the app's render report — the same one the in-app
@@ -157,12 +159,12 @@ is how to tell the two apart in a hurry.
 There is no second machine, so **ssh this VM to itself**. That is set up
 too: the key is `~/.config/ai-app/ssh-self` (its public half is in
 `~/.ssh/authorized_keys`, labelled removable), and the real config carries a
-setup called **"this vm over ssh"** — `bob@127.0.0.1` with that
+machine called **"this vm over ssh"** — `bob@127.0.0.1` with that
 `identityFile` plus
 `options: ["StrictHostKeyChecking=no", "UserKnownHostsFile=/tmp/ai-app-known-hosts"]`
 so it touches nothing real — offering `claude-cli` and `llama-cpp`. It is the
 whole rig for "does a remote llama session work", since the far machine is
-this one and the model file is the same file. For a throwaway setup of your
+this one and the model file is the same file. For a throwaway machine of your
 own, point a provider's `command` at something harmless like `/bin/echo`
 rather than at `claude`: the transport is what is under test, the process
 exiting immediately is the signal, and it costs no tokens. The remote login