cco: OAuth refresh fix

Previously. Problem statement: cco is not able to autonomously refresh the OAuth token used by claude. The manual workaround is to run an one-off unsandboxed claude, and then get back to cco afterwards. Why? Run /doctor within cco and compare its output with /doctor within an unsandbox claude code session. The culprit: Warning: macOS Keychain is not writable (security: SecKeychainItemCreateFromContent (<default>): UNIX[Operation not permitted]; add-generic-password: returned 100001). Console login will fail to save your API key. Fix: Run: security unlock-keychain ~/Library/Keychains/login.keychain-db — if that doesn't fix it, your login keychain password may be out of sync with your account password: open Keychain Access, select the 'login' keychain, then Edit → Change Password for Keychain 'login'. So now I am passing --add-dir ~/Library/Keychains to cco, and the warning is finally gone! commit 5c111a7caffb4e6b3dc4d678d4fc1bd6c8296ae5 Author: Thiago Perrotta <{redacted}> Date: Sun…