feat(claude-profile): add provider selection (model + endpoint + credentials)

Introduces provider files (`data/claude-profile/providers/*.yaml`) that
bundle model ID, API base URL, API key source, and extra env vars. Phase 2.5
(provider selection) added between mode selection and launch, with a default
derived from the mode's driver field so existing Anthropic usage is unchanged.

Ships 5 providers: anthropic-haiku/sonnet/opus/opus-1m and minimax-sonnet.
MiniMax token decrypted from agent-runtimes SOPS env, stored at
~/.claude-secrets/minimax-auth-token. Adding new providers = one YAML file,
no script changes.

58 dryrun tests passing (up from 37).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

context/claude-profile-modes.md

@@ -2,15 +2,17 @@
 
 ## Status
 
-**Core features shipped and pushed (commit 143b325). NOT yet exercised in a real `claude` launch.**
+**Provider support added. 58 dryrun assertions passing. MiniMax token provisioned. NOT yet exercised in a real `claude` launch.**
 
 ## What's done
 
 | Component | State |
 |---|---|
-| Profile + mode picker (phases 1-3) | Done, 37 dryrun assertions passing |
+| Profile + mode + provider picker (phases 1-3) | Done, 58 dryrun assertions passing |
 | 5 mode files with `escalates_to` frontmatter | Done |
-| `active-mode.env` written on every launch | Done (includes `CLAUDE_ESCALATES_TO`) |
+| 5 provider files (4 Anthropic + minimax-sonnet) | Done (`data/claude-profile/providers/`) |
+| `active-mode.env` written on every launch | Done (includes `CLAUDE_PROVIDER`) |
+| MiniMax token decrypted + stored | Done (`~/.claude-secrets/minimax-auth-token`, 600 perms) |
 | statusline.sh — `[Sonnet→Opus] deep · topic` format | Done (reads `CLAUDE_CONFIG_DIR/active-mode.env`) |
 | Root CLAUDE.md — auto-select project from cwd or `CLAUDE_PROJECT` | Done |
 | Preset support (`presets.yaml`) | Done (example at `data/claude-profile/presets.yaml.example`) |
@@ -21,19 +23,25 @@
    ```bash
    ln -sf "$HOME/dev/claude/small-scripts/scripts/claude-profile" "$HOME/sbin/claude-profile"
    ```
-2. **Real-launch test:** `claude-profile oreillyit --mode chat` first (lowest blast radius — Haiku driver, no project, no async). Verify:
-   - Mode body appears in system prompt (CLAUDE.md announces the mode)
+2. **Real-launch test — Anthropic first:** `claude-profile oreillyit --mode chat` (press Enter to accept default anthropic-haiku). Verify:
+   - Mode body appears in system prompt
    - Status bar shows `[Haiku] chat` format
-   - `~/.claude-oreillyit/active-mode.env` is written with correct values
-3. **Auto-select test:** launch from inside a project dir (`cd ~/dev/claude/small-scripts && claude-profile oreillyit --mode quick`) — should skip the project picker and announce "Auto-selected project small-scripts"
-4. **Then `--mode deep`** to verify plan-mode auto-engagement and the `[Sonnet→Opus] deep · topic` status bar format
-5. **If anything's off**, `tests/test-claude-profile.sh` is the fast feedback loop
+   - `~/.claude-oreillyit/active-mode.env` has `CLAUDE_PROVIDER=anthropic-haiku`
+3. **MiniMax launch test:** `claude-profile oreillyit --mode quick --provider minimax-sonnet`. Verify:
+   - Claude starts and is responsive
+   - `ANTHROPIC_BASE_URL` is set to MiniMax endpoint (check via a "what model are you?" prompt)
+4. **If anything's off**, `tests/test-claude-profile.sh` is the fast feedback loop
+
+## Adding new providers
+
+Drop a new `data/claude-profile/providers/<name>.yaml` file. For third-party providers:
+- Decrypt credentials and store the raw token in `~/.claude-secrets/<provider>-auth-token`
+- Provider YAML needs: `base_url`, `api_key_env`, `api_key_file`, and any `extra_env` flags the provider requires
 
 ## Remaining follow-ups (from FUTURE.md)
 
 1. **`bg-model-call` wrapper** — `deep` and `hybrid` modes reference it but it doesn't exist yet. Own spec + script entry.
 2. **`switch mode` skill** — mid-session re-pick writes new `active-mode.env` for the next `/clear`. Lower priority.
-3. **MiniMax inverted architecture** — long research project; requires token-budget sketch first.
 
 ## Key gotchas
 
@@ -41,3 +49,4 @@
 - **Root `~/dev/claude/CLAUDE.md` is also not git-tracked** — changes there are also immediately live.
 - **`CLAUDE_CONFIG_DIR` must be exported** by claude-profile before `exec claude`. The statusline hook inherits it from the claude process environment.
 - **`read -rp` under `set -e` exits silently if stdin is not a TTY.** The picker guards all interactive reads with `[[ -t 0 ]]`. See `memory/gotchas-bash.md`.
+- **MiniMax token is in `~/.claude-secrets/`** — gitignored, plaintext, 600 perms. The SOPS-encrypted version in agent-runtimes is for container agents only.