fix(cli): drop dead API key prompt and tighten TTY detection in onboarding

[continued-agent]

Summary

Two fixes plus a regression-test sweep for the new provider-picker onboarding flow.

fix(cli): stop collecting API key in provider picker

The picker previously prompted for an API key with masked input and then silently discarded the typed value, writing only a ${{ secrets.NAME }} reference into ~/.continue/config.yaml. The user reasonably expects the key they just typed to be saved, but it was thrown away.

• Drop the apiKey step and replace it with a confirm step that names the env var the user needs to set (Set OPENAI_API_KEY in your shell, ~/.continue/.env, or your project .env before running the CLI.) and waits for any keypress.
• Remove the now-unused model state and the secret masking branch on InputLine.
• Update README.md, CHANGELOG.md, and spec/onboarding.md to drop the "enter the API key" wording and document the env-var reminder.

fix(cli): also treat missing stdout TTY as non-interactive

runOnboardingFlow only checked process.stdin.isTTY. In some CI/container setups stdin looks like a TTY while stdout is redirected, which would cause Ink to hang on useInput. Add process.stdout.isTTY to the heuristic and a comment explaining the conservative choice. Add a regression test.

Test coverage

Add ink-testing-library coverage for ProviderPicker (none existed) to prevent the cascade of fix-after-fix commits we saw in this area:

• renders the provider list with the first provider selected
• navigates down with j
• cancels on Escape
• confirms a simple provider, calls onSelect with the correct apiKeySecret, and shows the env-var reminder (catches the bug fixed above)
• collects an apiBase for providers that need one and passes it through to onSelect

Validation

• npx prettier --check on all 7 touched files: clean
• npx eslint on ProviderPicker.tsx, ProviderPicker.test.tsx, onboarding.ts, onboarding.test.ts: clean
• npx tsc --noEmit -p tsconfig.json filtered to my files: no new errors (other tsc errors are pre-existing in core/ from missing local-package builds)
• npx vitest run src/ui/components/ProviderPicker.test.tsx src/onboardingProviders.test.ts: 9/9 pass

Out of scope (not changed, called out for reviewers)

• claude-sonnet-4-6 is the intended Anthropic model identifier across the repo (core/llm/llms/Anthropic.ts, packages/llm-info/src/providers/anthropic.ts, etc.). No change.
• The existing pattern of "refactor/feat immediately followed by a fix commit" suggests npm run format / npm run lint / npm test are not being run before opening a PR, contrary to extensions/cli/AGENTS.md. Husky + lint-staged only runs prettier --write on staged files. Consider strengthening the pre-push or CI gate.

Files changed

extensions/cli/CHANGELOG.md
extensions/cli/README.md
extensions/cli/spec/onboarding.md
extensions/cli/src/onboarding.test.ts
extensions/cli/src/onboarding.ts
extensions/cli/src/ui/components/ProviderPicker.tsx
extensions/cli/src/ui/components/ProviderPicker.test.tsx  (new)