Recognize sign-in failures for every agent and fall through

Codex re-runs device login on revoked, expired, or reused sessions and
token_revoked/401 errors, not only invalid_refresh_token. Claude and
OpenCode credential rejections are classified too. Sign-in failures fall
through to the next profile, and the failure comment names each tried
profile with a fixed reason label.

src/runtime.ts

@@ -1,6 +1,6 @@
 import { join } from "jsr:@std/path@1";
 import { parseCredentials } from "./credentials.ts";
-import type { BotProfile } from "./profiles.ts";
+import type { BotProfile, ProfileFailure } from "./profiles.ts";
 
 const FIRST_PROFILE_UID = 20_000;
 
@@ -28,7 +28,7 @@ export type RuntimeOutcome =
     anchorsPath: string;
     profile: Pick<RuntimeProfile, "type" | "model">;
   }
-  | { ok: false };
+  | { ok: false; failures: ProfileFailure[] };
 
 async function writePrivate(
   path: string,