fix: write auth profiles to multi-agent path during onboarding

- Onboarding now writes auth profiles under ~/.clawdbot/agents/main/agent so the gateway sees credentials on first start.
- Hardened onboarding test to ignore legacy env vars.

Thanks @minghinmatthewlam!

src/commands/onboard-auth.test.ts

@@ -36,9 +36,10 @@ describe("writeOAuthCredentials", () => {
     delete process.env.CLAWDBOT_OAUTH_DIR;
   });
 
-  it("writes auth-profiles.json under CLAWDBOT_STATE_DIR/agent", async () => {
+  it("writes auth-profiles.json under CLAWDBOT_STATE_DIR/agents/main/agent", async () => {
     tempStateDir = await fs.mkdtemp(path.join(os.tmpdir(), "clawdbot-oauth-"));
     process.env.CLAWDBOT_STATE_DIR = tempStateDir;
+    // Even if legacy env vars are set, onboarding should write to the multi-agent path.
     process.env.CLAWDBOT_AGENT_DIR = path.join(tempStateDir, "agent");
     process.env.PI_CODING_AGENT_DIR = process.env.CLAWDBOT_AGENT_DIR;
 
@@ -50,8 +51,11 @@ describe("writeOAuthCredentials", () => {
 
     await writeOAuthCredentials("anthropic", creds);
 
+    // Now writes to the multi-agent path: agents/main/agent
     const authProfilePath = path.join(
       tempStateDir,
+      "agents",
+      "main",
       "agent",
       "auth-profiles.json",
     );
@@ -64,5 +68,12 @@ describe("writeOAuthCredentials", () => {
       access: "access-token",
       type: "oauth",
     });
+
+    await expect(
+      fs.readFile(
+        path.join(tempStateDir, "agent", "auth-profiles.json"),
+        "utf8",
+      ),
+    ).rejects.toThrow();
   });
 });