kohen: fallback for Claude Code when the gate is down

Every Claude Code session on the dev VM goes through bikoret.ch; when
the pod is not ready the session cannot reach Anthropic (2026-10-15:
Doorpost drift → 503 → the transmitter locked out, recovered by hand).
An `env` entry in ~/.claude/settings.json overrides the shell
environment (verified), so `env -u … claude` is not a recovery while
the gate is armed there.

- scripts/claude-direct: start straight to Anthropic via a --settings
  JSON on the command line, which outranks every settings file.
- scripts/claude-bikoret: probe the gate first; if it does not answer,
  say so and exec claude-direct (BIKORET_STRICT=1 refuses instead).
- scripts/bikoret-settings on|off|status: arm/disarm the gate for every
  launcher; `on` writes the key (kohen only), `off` is the recovery.
- KOHEN.md: the fallback and the order of recovery.

Tested 2026-10-15: dead gate armed in settings → plain claude hangs,
claude-direct answers; probe at a dead host → fallback + answer; live
gate → answer with the fringe.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

scripts/claude-bikoret

@@ -0,0 +1,27 @@
+#!/bin/bash
+# Start Claude Code behind the gate (KOHEN "Claude Code behind the gate").
+# The courtyard key is read from the keys file at launch and never written anywhere else.
+#
+# Fallback (2026-10-15): before launching, probe the gate. If bikoret.ch or
+# the pod is down, say so and start DIRECT to Anthropic instead
+# (claude-direct), unless BIKORET_STRICT=1 — then refuse, so a session that
+# must be examined is never silently unexamined.
+GATE="https://bikoret.ch/gate/anthropic"
+code=$(curl -sS -m 6 -o /dev/null -w '%{http_code}' -X POST "$GATE/v1/messages" \
+       -H 'content-type: application/json' -d '{}' 2>/dev/null)
+case "$code" in
+  401|400|422) ;;   # the gate answered: it is up (it refuses an unkeyed/empty request)
+  *)
+    echo "bikoret gate not answering (HTTP ${code:-000}) — see: curl -s https://bikoret.ch/kodesh/health" >&2
+    if [ "${BIKORET_STRICT:-0}" = "1" ]; then
+      echo "BIKORET_STRICT=1: refusing to start unexamined" >&2; exit 1
+    fi
+    echo "starting DIRECT to Anthropic (claude-direct); re-run claude-bikoret when the gate is back" >&2
+    exec "$HOME/.local/bin/claude-direct" "$@"
+    ;;
+esac
+KEY=$(awk '$1=="courtyard"{print $2}' "$HOME/.config/shorashim/api_keys")
+[ -n "$KEY" ] || { echo "no courtyard key in ~/.config/shorashim/api_keys" >&2; exit 1; }
+export ANTHROPIC_BASE_URL="$GATE"
+export ANTHROPIC_CUSTOM_HEADERS="X-Bikoret-Key: $KEY"
+exec claude "$@"