fix(ci): write Brev credentials file so CLI authenticates on runner (#1639)

## Summary
- Write `~/.brev/credentials.json` during the "Install Brev CLI"
workflow step
- The Brev CLI v0.6.322 does not read `BREV_API_TOKEN` from the
environment — it requires a credentials file
- The `brev login --token` call was removed in 374a847 (#1470),
breaking all E2E runs since

## Root Cause

PR #1470 replaced `brev("login", "--token", process.env.BREV_API_TOKEN)`
with a `brev("ls")` pre-check (`hasAuthenticatedBrev`), but nothing
writes the credentials file on the ephemeral GH Actions runner. Result:
`brev ls` fails silently, `hasAuthenticatedBrev` returns false,
`describe.runIf()` skips the entire suite, and CI reports success with 0
tests run.

## Evidence
- Last working run (Apr 4):
[23968693963](https://github.com/NVIDIA/NemoClaw/actions/runs/23968693963)
— 1 passed, 988s
- Broken runs (Apr 8):
[24160260650](https://github.com/NVIDIA/NemoClaw/actions/runs/24160260650),
[24160572779](https://github.com/NVIDIA/NemoClaw/actions/runs/24160572779),
[24161141317](https://github.com/NVIDIA/NemoClaw/actions/runs/24161141317)
— all 1 skipped, <1s

## Test plan
- [ ] Merge to main, trigger `e2e-brev` workflow with `TEST_SUITE=full`
— confirm tests actually run (not skip)

Fixes #1638

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Improved CI end-to-end workflow: requires and validates an API token
before running, securely writes and protects credential data, and
verifies authentication to ensure reliable automated test runs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>

Author: cjagwani

.github/workflows/e2e-brev.yaml

@@ -144,12 +144,27 @@ jobs:
           cache: npm
 
       - name: Install Brev CLI
+        env:
+          BREV_API_TOKEN: ${{ inputs.brev_token || secrets.BREV_API_TOKEN }}
         run: |
           # Brev CLI v0.6.322+ — CPU instances use `brev search cpu | brev create`
           # Startup scripts use `brev create --startup-script @file` (not brev start --cpu)
           curl -fsSL -o /tmp/brev.tar.gz "https://github.com/brevdev/brev-cli/releases/download/v0.6.322/brev-cli_0.6.322_linux_amd64.tar.gz"
           tar -xzf /tmp/brev.tar.gz -C /usr/local/bin brev
           chmod +x /usr/local/bin/brev
+          # Brev CLI does not read BREV_API_TOKEN from env — it requires
+          # ~/.brev/credentials.json. The login call was removed in #1470
+          # (374a847d), breaking CI. Write the credentials file so `brev ls`
+          # works in the test harness's hasAuthenticatedBrev check.
+          if [ -z "${BREV_API_TOKEN:-}" ]; then
+            echo "::error::BREV_API_TOKEN is empty — cannot authenticate Brev CLI."
+            exit 1
+          fi
+          mkdir -p ~/.brev
+          umask 077
+          printf '{"refresh_token":"%s"}' "$BREV_API_TOKEN" > ~/.brev/credentials.json
+          chmod 600 ~/.brev/credentials.json
+          brev ls >/dev/null
 
       - name: Install dependencies
         run: npm install --ignore-scripts