test(cli): assert claim-on-login surfaces claimed-token count

[mastermanas805]

What

Adds cmd/claim_login_test.go — integration coverage for the CLI claim path.

The CLI has no standalone claim command. Anonymous resources are claimed as a side effect of the login device-flow:
POST /auth/cli → poll GET /auth/cli/{id} → on success the response carries claimed_tokens, and runLogin prints "N anonymous resource token(s) claimed to your account." (login.go:115-116).

Why (the gap)

The existing suite already covers the poll helpers (login_poll_test.go, login_timeout_test.go, coverage_login_test.go) and the runLogin happy/error branches (coverage_push95_test.go). But every runLogin test asserts only err == nil and discards stdout — the claim-print branch runs but is never read. A green runLogin is therefore not proof the user actually sees their claimed-token count.

Per CLAUDE.md rule 12 ("Shipped ≠ Verified": the verification surface must match the failure surface), this PR closes that gap by capturing stdout and asserting the rendered claim output.

New cases (vs already-covered)

Case	New?	Asserts
Multi-token claim	NEW	rendered "2 ... claimed to your account." line and credentials persisted to config
Zero-token claim	NEW	no claim line printed (guards against a misleading "0 ... claimed")
Pending-then-success (multi-poll)	NEW	claim count survives the 202→200 path (existing multi-poll test asserts only the API key)

All three mirror the existing httptest stub + withCleanState/withTestAPI/withShortPolls/captureStdout helpers. Named constants, no inline string literals.

Gate

go build ./...   # OK
go vet ./...     # OK
go test ./... -count=1   # all packages ok

cmd-package coverage: 95.5% (above 95% floor). Diff is test-only; the targeted claim-print branch is covered.

🤖 Generated with Claude Code