Configure first-run launches through the launch's --provider

[masonc08]

Problem

ug claude --provider <relayed MPS> --workspace <url> fails on a fresh state, and keeps failing after ug revert:

Claude subscription relay cannot start because enterprise managed settings define apiKeyHelper,
env.ANTHROPIC_BASE_URL, env.ANTHROPIC_CUSTOM_HEADERS at /Library/Application Support/ClaudeCode/managed-settings.json.

When the workspace or tool isn't in state yet, _launch_tool runs _auto_configure_tool before it looks at --provider. Auto-configure set Claude up for the default gateway path. In an interactive terminal, that wrote the gateway auth keys into the OS-managed settings file. The same launch then configured the relayed provider, and the relay guard in _reconcile_managed_settings rejected the keys ug had just written. ug revert clears both the file and the state, so the next launch did the same thing again.

The only way out was to configure non-interactively first (ug configure --agents claude --workspace <url> < /dev/null, which skips the managed write) and then run ug claude --provider <mps>.

Fix

Pass the launch's --provider through _auto_configure_tool into configure_single_tool. _configure_one already resolves a relayed service and configures it as relayed, which never writes the managed file. With this change, the first-run setup matches the launch that follows it. The existing error message's advice ("run ucode revert first") now works too.

Not covered: a relayed provider that comes from a managed coding-agent config, with no --provider, on a first run. That config is only fetched after auto-configure. Handling it would mean having the relay path strip managed keys that ug itself wrote, instead of failing on them. That's a larger change to the sudo write path, so it's left for a follow-up.

Testing

• New: test_first_run_configures_through_launch_provider and test_auto_configure_forwards_provider in tests/test_cli.py, and test_explicit_relayed_provider_configures_relayed in tests/test_agents_init.py. All three fail without the source change.
• Updated the existing auto-configure call assertions to include provider=None.
• uv run pytest: 3577 passed. The 7 failures (smart-routing PTY and test_e2e_user_agent) and the Windows smart-routing file's pytest crash reproduce the same way on clean main on my Linux box.
• ruff check, ruff format --check, ty check src/: clean.

This pull request and its description were written by Isaac.