Transient daemon leaves stale auth_required in daemon-auth-status.json after keychain re-check recovery

Environment: Claude Code 2.1.234 (native install), Linux (NixOS), headless transient daemon (claude daemon run --origin transient).

What happened: the daemon's proactive OAuth refresh failed, so it wrote <config-dir>/daemon-auth-status.json = {"status":"auth_required","since":...} (plus a daemon-auth-cooldown stamp). Sixty seconds later it recovered via its keychain re-check — but the recovery path never rewrites or removes the status file. The daemon later idle-exited with the file still reading auth_required, leaving it stale on disk indefinitely.

From daemon.log:

[2026-08-18T03:26:03.212Z] [supervisor] auth: proactive refresh starting
[2026-08-18T03:26:03.451Z] [supervisor] auth: proactive refresh failed, signalling re-auth required
[2026-08-18T03:26:03.463Z] [supervisor] auth: headless daemon cannot complete OAuth — run `claude auth login` to refresh
[2026-08-18T03:26:03.463Z] [supervisor] auth: no token found, will re-check keychain every 30s
[2026-08-18T03:27:03.464Z] [supervisor] auth: scheduling proactive refresh in 28500s
[2026-08-18T03:27:03.464Z] [supervisor] auth: token found via keychain re-check
...
[2026-08-18T05:04:06.756Z] [supervisor] shutting down (cause=idle_exit, uptime=30845s, leases=0, live_workers=0)

daemon-auth-status.json throughout and after: {"status":"auth_required","since":1787023563460} — mtime matching the 03:26 failure, never updated at the 03:27 recovery nor on shutdown.

Expected: on recovery (token found), the daemon rewrites the status file (e.g. status: ok) or removes it, so on-disk auth status reflects reality.

Impact: minor — anything surfacing that file (status UIs, tooling checking daemon auth health) reports re-auth required while auth is actually healthy.