Use Native Credential Proxy

This skill replaces the OneCLI gateway with NanoClaw's built-in credential proxy. Containers get credentials injected via a local HTTP proxy that reads from .env — no external services needed.

Phase 1: Pre-flight

Check if already applied

Check if src/credential-proxy.ts is imported in src/index.ts:

grep "credential-proxy" src/index.ts

If it shows an import for startCredentialProxy, the native proxy is already active. Skip to Phase 3 (Setup).

Check if OneCLI is active