- Air calendar event card: card-level click handler now bails when the
  click originates inside a [data-action] element or <a href>, so the
  join-meeting link no longer also opens the Edit Event modal. Both
  listeners live on document, so stopPropagation can't help — siblings,
  not parent/child.
- UI accessibility: scope the nav-buttons assertions to the navigation
  landmark and use exact-match names so dashboard account buttons like
  "ACCOUNT 23@qasim.nylas.email" can't satisfy the broader regex.

1. EncryptedFileStore.Get migration race: Get held only RLock while
   loadSecrets→decrypt could run migrateToPassphrase, which writes BOTH
   .secrets.salt and .secrets.enc. Two concurrent first-readers could
   interleave those writes and leave a salt/ciphertext pair that no
   longer decrypts. Get now takes the exclusive Lock. Adds a
   concurrency test (32 goroutines, race detector clean) that re-opens
   the store from a cold start and verifies round-trip after migration.

2. doctor checkGrants treated client_secret as required, but the rest
   of the codebase (auth/config.go, auth/show.go, auth/helpers.go,
   auth/migrate.go) treats it as optional. Now only API key + client
   ID are required; ErrSecretNotFound on client_secret is treated as
   empty. Real keyring read failures still surface explicitly.

3. preflightTunnelChoice TTY check was hard-wired to term.IsTerminal,
   so the EOF-on-secret and empty-secret tests were permanently
   skipped via an isTerminalStdin() helper that always returned false.
   The function now takes an `interactive bool` parameter (runServer
   passes term.IsTerminal; tests pass true). Cloudflared/brew probes
   are now package-level seams so tests can drive the secret-prompt
   path without a real binary on PATH. Added a new positive-path test
   for explicit unsigned-confirm.

The /v3/grants LIST endpoint can lag freshly-created managed grants by
tens of seconds (>70s observed) while GET-by-id is strongly consistent.
Tests that relied on list-based visibility checks were hitting the
90-second deadline intermittently.

Adapter (managed_grants.go):
- Drop the server-side `provider=nylas` filter; LIST without filter
  surfaces fresh grants almost immediately. Filter to provider
  client-side. Trades ~4x more page bytes for freshness.
- Add cycle detection on next_cursor and a 1000-page cap so a
  misbehaving server can't trap pagination in an unbounded loop.

CLI (agent_scope.go + helpers.go + create.go + list.go +
policy_list_get.go):
- loadAgentPolicyScope upserts the configured default agent (via
  NYLAS_GRANT_ID or default grant) into the listed accounts, and
  back-fills any missing policy via GetPolicy. Rule and policy CLI
  surfaces now succeed even when the LIST hasn't propagated.
- Apply the same GET-by-id fallback to resolveAgentID (email->ID),
  findExistingAgentAccountByEmail, and runList rendering.

Integration tests:
- New waitForAgentByID helper using the consistent GET endpoint.
- Cleanups simplified to use the create-returned ID directly.
- Set NYLAS_GRANT_ID immediately after create so subsequent CLI calls
  hit the GET-by-id fallback.

File splits to honor the 500-line ideal limit:
- agent_scope.go: extracted policy-scope helpers + agentPolicyScope
  type (shared by rule.go and policy_list_get.go).
- rule_print.go: extracted rule formatting helpers from rule.go.
- agent_scope_test.go and rule_print_test.go: mirror the source split.

Verification: 24/24 agent integration tests PASS in 294s (previously
6 timed out at 90s); unit tests, build, vet, lint all green.