First-run setup: credential preflight, cross-platform runner, Makefile

[anmolg1997]

Why

A teammate hit setup failures on a fresh clone (two screenshots). Root-causing the second one (a bare live run) found a real engine bug, not just an ergonomics gap:

• A live run with no API key either crashes with a raw SDK TypeError ("Could not resolve authentication method"), or — if DISCOVERY_OFFLINE lingers from an earlier golden experiment — prints the misleading offline mode: no cached response … use the golden run. Neither tells you the real problem: your key isn't set.
• The on-disk LLM cache (.cache/) is gitignored, so a fresh clone has nothing to replay live. Only the committed golden/ does, via --golden.
• uv also warned about a stale VIRTUAL_ENV pointing at another project's venv.

This PR fixes the root cause and makes setup one command on Mac/Linux/Windows.

Engine fixes (behaviour unchanged for valid runs)

• Credential preflight (run.py) — on any non---golden (live) path, if the selected provider has no usable credentials, stop before any work with one actionable line and exit 2:

  error: this is a LIVE run but the 'anthropic' provider has no usable credentials (missing/placeholder: ANTHROPIC_API_KEY).
    Fix one of these, then re-run:
      • Add your key to v1/.env  (cp .env.example .env, then fill it in),
      • verify it with:  uv run python scripts/doctor.py
    Or run the OFFLINE demo with no key and no cost:
      uv run python run.py --domain o2c --golden --auto-resolve
  

• env.py — missing_credentials() / credentials_present(): provider-aware (Anthropic key or the full Azure var set), and the .env.example placeholder (sk-ant-...) counts as missing so a freshly-seeded .env fails cleanly instead of handing a bogus key to the SDK.
• llm.py — provider calls are wrapped so any auth/network SDK error becomes a clean LLMError with the real fix (no traceback); the offline-mode messages now say it's cache-only (DISCOVERY_OFFLINE) and how to go live.

Cross-platform, single source of truth

• tasks.py (new, stdlib-only) — python tasks.py setup|run|live|console|report|ui|open|doctor|test|clean|distclean. Works on Mac / Linux / Windows. Strips a stray VIRTUAL_ENV before every uv call (kills the "does not match .venv" warning), uses arg-list subprocess + webbrowser (space- and OS-safe), prereq-checks uv/npm with install hints.
• Makefile — now a thin wrapper that forwards each target to tasks.py, so make <t> (Mac/Linux) and python tasks.py <t> (Windows) run identical logic.
• README — Windows quickstart; prerequisites called out; note that a live run preflights credentials.

Default path is keyless & free

make run / python tasks.py run is a deterministic golden replay → builds the explorer → opens it. No key, no cost, no cache-miss wall.

Verified

• Repro no key + live → clean preflight STOP (exit 2), no traceback ✓
• Repro placeholder key + live → same clean STOP ✓
• no key + --golden → full success (exit 0) ✓
• make report / tasks.py report with a deliberately-stale VIRTUAL_ENV exported → no warning, golden replay completes ✓
• tasks.py run full chain (report → build → open) ✓
• Suite 248 passed, 100% branch coverage held, pyrefly clean (incl. tasks.py) ✓