feat(claude): adopt claude-agent-acp 0.74.0 and survive its auth_required refusal

0.74.0 changed how a mid-session sign-out ends a turn. Through 0.73.0 an
AIR client's prompt was settled with a disguised `end_turn` carrying the
failure record; 0.74.0 publishes a session-scoped `access` record on the
update channel AND rejects the prompt with ACP's `authRequired`, because
that rejection is what starts a client's own auth flow.

codeg consumed the record but not the rejection: `run_conversation_loop`
propagated every prompt error, so the sign-out would have unwound the
whole connection — terminal Error, Disconnected, conversation flipped to
Cancelled — for something the adapter deliberately keeps recoverable on
the same session. The loop now keeps an `ErrorCode::AuthRequired`
rejection turn-scoped: it synthesizes an `auth_required` stop reason,
emits the non-terminal `turn_failed_auth_required` error, records the
turn end, drains permissions with `TurnComplete`, cascade-cancels
in-flight delegations, and goes back to idle with the session intact.
Agent-agnostic — every agent that answers -32000 here wants credentials,
not a teardown.

The new reason is wired through the consumers that enumerate stop
reasons (conversation status, pet state) and localized in all ten
locales. Delegation gets its own `ChildAuthRequired` outcome so a
sub-agent's sign-out reads as "needs sign-in" rather than the parent LLM
being told its child "ended with unrecognized stop reason".

The rest of the release needs no code: `--hide-claude-auth` and its
`reason` refinement are argv-gated and unreachable here, the gateway
`authenticate` / `providers/*` hardening touches methods codeg never
calls, and the 401-retry-warning, stale-auth-record and orphan-query
fixes land for free.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>