fix(e2e): update input tests for new agent CLIs + auto-load email creds (#2877)

* fix(e2e): update input tests for latest agent CLI interfaces + auto-load email creds

claude: add --dangerously-skip-permissions --no-session-persistence to bypass
trust dialog when running in /tmp/e2e-test (not in ~/.claude.json trusted
projects list written during install)

codex: replace `codex exec --full-auto` (removed in new @openai/codex) with
`codex -q -a full-auto` — quiet mode + full-auto approval, no exec subcommand

email: auto-load RESEND_API_KEY + KEY_REQUEST_EMAIL from
/etc/spawn-key-server-auth.env (QA VM) or ~/.config/spawn/resend.env (local)
so send_matrix_email fires on every e2e run, not just QA-cycle runs

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(e2e): correct claude and codex input test commands

- claude: pass prompt as positional arg to claude -p instead of piping
  via stdin (stdin pipe breaks through SSH exec chain, causing
  "Input must be provided either through stdin or as a prompt argument"
  error)
- codex: revert to `codex exec --full-auto` subcommand (correct for
  v0.116.0 — previous -q -a full-auto flags don't exist)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: spawn-qa-bot <qa@openrouter.ai>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

sh/e2e/e2e.sh

@@ -34,6 +34,23 @@ source "${SCRIPT_DIR}/lib/soak.sh"
 source "${SCRIPT_DIR}/lib/interactive.sh"
 source "${SCRIPT_DIR}/lib/ai-review.sh"
 
+# ---------------------------------------------------------------------------
+# Auto-load Resend email credentials when not already set.
+# Sources /etc/spawn-key-server-auth.env (QA VM) or ~/.config/spawn/resend.env
+# (local dev) to populate RESEND_API_KEY and KEY_REQUEST_EMAIL.
+# This ensures send_matrix_email fires on manual runs, not just QA-cycle runs.
+# ---------------------------------------------------------------------------
+if [ -z "${RESEND_API_KEY:-}" ] || [ -z "${KEY_REQUEST_EMAIL:-}" ]; then
+  for _cred_file in /etc/spawn-key-server-auth.env "${HOME}/.config/spawn/resend.env"; do
+    if [ -f "${_cred_file}" ]; then
+      # shellcheck source=/dev/null  # path is dynamic
+      set -a; source "${_cred_file}" 2>/dev/null; set +a
+      break
+    fi
+  done
+  unset _cred_file
+fi
+
 # ---------------------------------------------------------------------------
 # All supported clouds (excluding local — no infra to provision)
 # ---------------------------------------------------------------------------

sh/e2e/lib/verify.sh

@@ -85,6 +85,10 @@ input_test_claude() {
 
   local output
   # claude -p (--print) reads the prompt from stdin.
+  # --dangerously-skip-permissions: bypass trust dialog for /tmp/e2e-test
+  #   (newer Claude Code requires per-directory trust; /tmp/e2e-test is not
+  #   in the ~/.claude.json trusted projects list written during install)
+  # --no-session-persistence: don't write session files to disk during tests
   # The prompt is read from the staged temp file — no interpolation in this command.
   output=$(cloud_exec "${app}" "\
     source ~/.spawnrc 2>/dev/null; \
@@ -92,7 +96,7 @@ input_test_claude() {
     _TIMEOUT='${INPUT_TEST_TIMEOUT}'; \
     rm -rf /tmp/e2e-test && mkdir -p /tmp/e2e-test && cd /tmp/e2e-test && git init -q; \
     PROMPT=\$(cat /tmp/.e2e-prompt | base64 -d); \
-    printf '%s' \"\$PROMPT\" | timeout \"\$_TIMEOUT\" claude -p" 2>&1) || true
+    timeout \"\$_TIMEOUT\" claude -p --dangerously-skip-permissions --no-session-persistence \"\$PROMPT\"" 2>&1) || true
 
   if printf '%s' "${output}" | grep -qx "${INPUT_TEST_MARKER}"; then
     log_ok "claude input test — marker found in response"
@@ -118,6 +122,7 @@ input_test_codex() {
   _stage_prompt_remotely "${app}" "${encoded_prompt}"
 
   local output
+  # codex exec --full-auto: non-interactive subcommand for v0.116.0+
   # The prompt is read from the staged temp file — no interpolation in this command.
   output=$(cloud_exec "${app}" "\
     source ~/.spawnrc 2>/dev/null; \