fix(core/auth): bootstrap code home on first run (#5969)

[zemaj]

Summary

• create the Code home directory before writing auth.json so Windows reinstalls don’t fail on missing parents
• treat a missing auth.json as "no auth yet" instead of an error, allowing first-run bootstrap to continue
• add regression tests covering parent directory creation, first-run load_auth, and CLI API-key login

Testing

• cargo test -p code-core load_auth_returns_none_when_auth_json_missing -- --nocapture
• ./build-fast.sh

Closes openai#5969.

[zemaj]

Pulled the branch and validated the first-run bootstrap locally:

• Called std::fs::create_dir_all unconditionally inside write_auth_json so concurrent boots and pre-existing directories remain safe without TOCTOU checks.
• Added cross-platform coverage: macOS-style paths with spaces, Windows backslash paths (cfg gated), read-only file rewrites, and unix permission failures to prove the new bootstrap behaves as expected.
• Confirmed the missing auth.json path now returns Ok(None) cleanly (first-run CLI flow works) and the new tests capture regressions.

Tests:

• cargo test -p code-core login_with_api_key_handles_paths_with_spaces
• cargo test -p code-core write_auth_json_fails_when_file_is_readonly
• cargo test -p code-core write_auth_json_propagates_permission_denied_unix
• ./build-fast.sh

Remaining risk: Windows ACL tightening is still inherited from the parent directory; follow-up hardening may be needed if stricter isolation is required.