feat(pasqal): validator list-projects mode + sandbox env passthrough (#194)

[kateebonner]

The amicode-side support for the #194 two-step Pasqal auth (username+password → pick a project). Pairs with harmoniqs/opencode PR #43 (the server + panel). Verified end-to-end live and in the VS Code sandbox.

Changes

scripts/pasqal-connector/pasqal_validate.py — list-projects mode
When PASQAL_PROJECT_ID is absent, authenticate on username+password alone and return the caller's projects so the panel can offer a picker:
{"ok": true, "mode": "list", "projects": [{"id","name"}], "token", "expires_at"}
(via GET account/api/v1/projects, the endpoint Jack's session confirmed). When a project id IS present, the original connect-and-validate behavior is unchanged. Fixed error messages only — no secret ever printed.

src/server_auth.ts — sandbox env passthrough
buildServerSpawnEnv spawns opencode with a deliberately minimal env (PATH + config + per-boot password). Added a fixed allowlist passthrough of non-secret amico state locations (AMICO_PASQAL_FILE / AMICO_CLOUD_FILE / AMICODE_CONNECTIONS_FILE / AMICODE_OPS_DIR / AMICO_PASQAL_KEYCHAIN_SERVICE / AMICO_PASQAL_VALIDATOR / AMICO_PYTHON) when set — keeps the minimal-env discipline (never a process.env spread; unset vars never appear) while letting an isolated sandbox point its ~/.amico + keychain slot elsewhere, separate from the real install.

Verification

• pnpm --filter amicode run typecheck — clean
• bun test packages/extension/test/server_auth.test.ts — 12 pass (base env unchanged when the vars are unset; passthrough only adds set keys)
• python3 -m py_compile pasqal_validate.py — clean; list-mode present
• Live: the two-step (username+password → list projects → choose → connected) runs against real Pasqal through the compiled binary and in the VS Code extension sandbox.

Notes

• Design of record: Pasqal Cloud auth: keychain silent re-auth (interim) + service account (target) — browser/device/refresh ruled out by evidence #194. At-rest / keychain discipline: ADR 0001 addendum (PR docs(adr): ADR 0001 addendum — Pasqal password to OS keychain (#194) #197).
• The validator's device listing uses Pasqal's device catalog; the connected panel no longer displays it (catalog ≠ project-entitled) — tightening the amico pasqal submit --device device set (Pasqal device path — optimized pulse to a Pasqal Cloud device through the Pasqal Connection #160) is a separate follow-up.

🤖 Generated with Claude Code