fix: restore plugin SDK export budget (#129383)

Restore the intended Plugin SDK provider-auth surface by keeping two unused, unshipped Claude compatibility types private while preserving the credential reader.

Refs #129052.

src/plugin-sdk/provider-auth-claude-compat.ts

@@ -1,5 +1,5 @@
 /** Retired Claude CLI credential shape kept only for source compatibility. */
-export type ClaudeCliCredential =
+type ClaudeCliCredential =
   | {
       type: "oauth";
       provider: "anthropic";
@@ -25,7 +25,7 @@ export type ClaudeCliCredential =
       helperHash: string;
     };
 
-export type ClaudeCliCredentialReadOptions = {
+type ClaudeCliCredentialReadOptions = {
   allowKeychainPrompt?: boolean;
   tryKeychainWithoutPrompt?: boolean;
   onStoredCredentialUnreadable?: () => void;

src/plugin-sdk/provider-auth.ts

@@ -69,11 +69,7 @@ export {
 } from "./provider-auth-write-compat.js";
 export { resolveEnvApiKey } from "../agents/model-auth-env.js";
 export { readCodexCliCredentialsCached } from "../agents/cli-credentials.js";
-export {
-  type ClaudeCliCredential,
-  type ClaudeCliCredentialReadOptions,
-  readClaudeCliCredentialsCached,
-} from "./provider-auth-claude-compat.js";
+export { readClaudeCliCredentialsCached } from "./provider-auth-claude-compat.js";
 export { suggestOAuthProfileIdForLegacyDefault } from "../agents/auth-profiles/repair.js";
 export {
   CUSTOM_LOCAL_AUTH_MARKER,