fix: retain agent readiness after transient auth failures

desktop/src/workspace/local-workspace-agent-catalog.cjs

@@ -220,7 +220,8 @@ class LocalWorkspaceAgentCatalog {
       checkedAt: this.now(),
     }
     const agent = this.detectedAgents().find(item => item.kind === kind)
-    if (agent && agent.availabilitySource !== 'provider-credential-unavailable') {
+    if (agent && agent.availabilitySource !== 'provider-credential-unavailable'
+        && !(credentialState === 'unknown' && agent.authenticated === true)) {
       agent.credentialState = credentialState
       agent.versionIdentified = agentVersionIdentified(agent)
       agent.compatible = agentCompatible(agent)

desktop/src/workspace/local-workspace-agent-invocation.cjs

@@ -1952,7 +1952,7 @@ class LocalWorkspaceAgentInvocation {
               ? agentStoppedError()
               : caughtError
       if (credentialFailure(error) && context.deferCredentialFailure !== true) {
-        this.markRuntimeCredential(kind, 'missing')
+        this.markRuntimeCredential(kind, 'unknown')
       }
       const status = parentTimedOut
         ? 'timeout'

desktop/src/workspace/local-workspace-auto-runner.cjs

@@ -522,10 +522,10 @@ class LocalWorkspaceAutoRunner {
         }
         if (control) return { result: null, removed: false, control, error }
         if (!unauthorizedFailure(error)) {
-          if (credentialFailure(error)) this.markRuntimeCredential(kind, 'missing')
+          if (credentialFailure(error)) this.markRuntimeCredential(kind, 'unknown')
           throw error
         }
-        this.markRuntimeCredential(kind, 'missing')
+        this.markRuntimeCredential(kind, 'unknown')
         this.recordAttempt(group, controller, {
           agentKind: kind,
           phase,