Make headless authentication fail fast with truthful exit codes

[rhoopr]

Problem

Headless authentication does not have one reliable fail-fast contract.

The password and Apple auth layers detect a non-terminal stdin, but the initial kei sync path catches TwoFactorRequired and waits up to 10 minutes for another process to submit a code. That is useful for a long-running service, but it makes a one-shot command look hung to CI, cron, and agents.

main_inner also classifies TwoFactorRequired as exit 0. A foreground caller can therefore treat an incomplete login as success unless it parses log text.

Other input paths are inconsistent:

• kei password set always prompts, even though the parent command exposes password-source options.
• kei reset state treats non-TTY EOF as a successful cancellation. Require --yes for non-interactive reset state #679 tracks that specific reset bug.
• Deprecate --password and ICLOUD_PASSWORD secret inputs #678 tracks deprecation of unsafe direct password inputs, so the replacement headless sources need to remain usable.

Proposed change

Define one input mode at startup and use it across login, sync, password management, reset, and setup.

• Non-TTY input should imply no-input behavior unless a command explicitly documents a long-running service workflow.
• One-shot sync and login should return immediately when operator action is required.
• The error should include the exact kei login get-code and kei login submit-code <CODE> flow.
• Foreground 2FA-required results should use a documented non-zero exit code.
• Watch/service mode may keep its durable wait-and-resume behavior, but that policy should stay in the service path rather than the global exit classifier.
• password set should either accept a safe explicit source or reject headless use before invoking the terminal prompt.

Acceptance criteria

• Headless one-shot sync and login never enter the 10-minute 2FA wait.
• A 2FA-required foreground command exits non-zero and prints the recovery commands.
• Service/watch mode can still wait for persisted auth state and resume after submit-code.
• password set has a documented scriptable path using a safe secret source, or fails immediately with an actionable message.
• Interactive password and 2FA prompts continue to work on a TTY.
• Binary-boundary tests cover TTY-independent login, sync, password, exit-code, and service behavior.

Relevant owners: src/lib.rs, src/password.rs, src/auth/, src/sync_loop.rs, and src/commands/service.rs.

Reference: 10 Principles for Agent-Native CLIs