ops-rotate-setup

## Purpose Initialize OAuth tokens for the multi-account Claude rotator system (the `account-rotation` daemon). For each configured account that does not already have a valid keychain token, delegate to `rotate.mjs --setup --only=<email> --auto --skip-valid`, which drives the browser-driver cascade (CDP-attach to a real Chrome → spawn Chrome with a real profile → bundled Chromium), polls Gmail for the magic link via `gog`, verifies the token, and writes it to the OS keychain under the schema the daemon/rotator consume: service `Claude-Rotation-<key>` (key = account `label` or `email`), keychain account `$USER` (override with `$CLAUDE_ROTATOR_KEYCHAIN_ACCOUNT`), value `{ "claudeAiOauth": { "accessToken": ... } }`. > Why delegate: a freshly launched Playwright Chromium is blocked by > claude.ai's Cloudflare Turnstile (the magic link is never sent), and a > hand-rolled web-cookie capture writes a credential shape no consumer reads. > `rotate.mjs` solves both correctly, so `setup-account.mjs` is a thin wrapper > around it. Use this skill when: - You ran `/ops:setup` and skipped the account-rotation step - You added a new Claude account and need to wire it in - A keychain entry was rotated/expired and needs re-init - You want to re-run only the OAuth portion without touching other ops config ## Rules (mandatory) - **Rule 0**: Never write real emails to any committed file. Account email and display name come from runtime user input only. - **Rule 1**: Max 4 options per `Ask...