feat(wizard-ci): mint and cache the gateway token for local e2e runs

[johncwaters]

Problem

Feedback wanted: ready to merge. Approve or request changes.

• Is caching the token per program, region and project under ~/.config/posthog the right default, or should local runs keep supplying WIZARD_CI_GATEWAY_TOKEN_FILE by hand?
• Is the per-run private copy of the token worth it, versus handing the harness the cache path directly?

A local pnpm wizard-ci <app> --e2e needs an AI gateway token, and the only way to get one was copying CI's. This makes the local path one browser login, then cached runs, which is as close to agent-friendly as the gateway allows today (the mint endpoint only accepts a wizard-app OAuth token; phs_ and phx_ keys are refused).

Companion PR: PostHog/wizard#1355, which adds the mint script this calls. Merge it first; without it a local run fails with a message naming the missing script.

Changes

• services/gateway-token/: ensureGatewayToken reuses a cached token until its refresh time, and otherwise runs the wizard's mint-gateway-token (browser login). The cache is keyed by program, region and project.
• CI is unchanged: an explicitly supplied WIZARD_CI_GATEWAY_TOKEN_FILE with no sidecar is used as-is, and with CI set an unusable token fails instead of opening a browser.
• A cached token is reused only when the sidecar's SHA-256 matches the token and its gateway URL is the region's gateway (or the configured WIZARD_CI_GATEWAY_URL).
• Each run hands the harness a private 0600 copy of the token and deletes it afterwards, so a concurrent run cannot swap the bearer mid-run.
• e2e.ts: resolves the program once for both the token and the harness, finds the wizard checkout the same way for minting and running, and never overwrites an explicit WIZARD_CI_GATEWAY_URL.
• pnpm gateway-token to mint or refresh by hand; .env.example explains leaving the token file unset locally.

How did you test this code?

• pnpm test:gateway-token (18 tests), test:source-app, test:feature-flag-checks, test:warehouse-checks and tsc --noEmit pass.
• Live on project 483112 with the wizard at feat(e2e): mint a gateway token locally with one browser login wizard#1355:
  • Local mint: one browser login wrote ~/.config/posthog/wizard-gateway-token-posthog-integration-us-483112 and its sidecar, both 0600, hash matching.
  • Cached reuse (basic-integration/django/django3-saas --e2e): no browser, cache file untouched, agent run completed through the gateway.
  • CI path (CI=true, sidecarless token file, basic-integration/next-js/15-app-router-saas --e2e): no mint, no sidecar written, agent run completed.
  • No per-run token copies left in $TMPDIR afterwards.
• Both e2e legs still fail full interactive flow reached keep-skills and skillsComplete. That is unrelated: wizard main's result JSON records a screen path ending at outro, although the captured frames reach keep-skills.
• Reviewed over three rounds by the Claude review lanes and a Codex security pass; the last round's per-run copy had no review after it.
• test:gateway-token is not added to checks.yml, because the push token lacks the workflow scope.

LLM context

Written with Claude Code; security review also by Codex (gpt-6-astra).

[johncwaters]

Closing along with PostHog/wizard#1355: we won't ship a public gateway-token mint. Local e2e keeps using an issued token in WIZARD_CI_GATEWAY_TOKEN_FILE, as main and CI already do.