Scout judge on Claude Code headless + OAuth token

[jdg2896]

Parent

#41

What to build

Migrate the Scout editorial judge off the anthropic Python SDK and onto the Claude Code CLI in headless mode, authenticated with a Claude subscription OAuth token instead of an API key. End-to-end: a workflow_dispatch Scout run reads its feeds, judges new entries via claude -p, and opens the same bot/scout-* Candidate PR as before — now billed to the subscription, not the API.

The judge runner becomes a deep module with a stable interface (judge_entry(system, title, url, summary) -> Judgment) that hides the headless invocation and JSON validation; the existing judge_candidate input schema is reused as the --json-schema. Per ADR-0001, the workflow installs the Claude Code CLI and swaps ANTHROPIC_API_KEY for CLAUDE_CODE_OAUTH_TOKEN. verify_links is left untouched (no LLM calls).

Acceptance criteria

• judge_entry invokes claude -p --model <id> --json-schema <schema> and returns a validated judgment; the anthropic SDK dependency is no longer used by Scout
• scout-resources.yml installs the Claude Code CLI and reads CLAUDE_CODE_OAUTH_TOKEN; no ANTHROPIC_API_KEY reference remains in the Scout workflow
• verify-links.yml is unchanged
• A maintainer-provisioned CLAUDE_CODE_OAUTH_TOKEN repo secret exists (via claude setup-token) and a manual workflow_dispatch run produces a Candidate PR identical in shape to the prior pipeline
• ADR-0001 is present and referenced

Blocked by

None - can start immediately (the code is AFK; the slice completes only once the maintainer provisions the secret — HITL).