chore: use Claude subscription auth, run fix sweep daily

- Swap anthropic_api_key -> claude_code_oauth_token in both Claude steps,
  reading CLAUDE_CODE_OAUTH_TOKEN from the CR_PAT GitHub Environment. Both
  jobs now declare `environment: CR_PAT` so the environment-scoped secret
  is reachable.
- Rename weekly_ai_fix.yaml -> daily_ai_fix.yaml (matches this repo's
  daily_/weekly_ filename convention) and change its cron from
  "0 3 * * SUN" to "0 3 * * *".
- on_issues_ai_triage.yaml already triggered on issues.opened; no schedule
  change was needed there.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/daily_ai_fix.yaml

@@ -1,12 +1,15 @@
 ---
-# Destination: .github/workflows/weekly_ai_fix.yaml
+# Destination: .github/workflows/daily_ai_fix.yaml
 #
 # Tier 2. One Opus 4.8 run at xhigh over the whole batch of `ai-triage` issues,
 # grouped by add-on, so it can spot the cross-issue patterns a per-issue run
-# never sees ("these four reports are all the same base image bump").
+# never sees ("these four reports are all the same base image bump"). Runs
+# daily rather than weekly, so batches (default limit 8) stay small and any
+# one day's failure doesn't block a week's worth of issues.
 #
-# Required secrets:
-#   ANTHROPIC_API_KEY
+# Auth:
+#   Claude Pro/Max subscription via the CR_PAT GitHub Environment, which
+#   holds the CLAUDE_CODE_OAUTH_TOKEN secret (generate with `claude setup-token`).
 #   AI_PR_TOKEN  — GitHub App token or PAT (repo scope). NOT GITHUB_TOKEN:
 #                  pull requests created with GITHUB_TOKEN do not trigger
 #                  other workflows, so your PR Check Build would never run.
@@ -15,7 +18,7 @@ name: AI fix sweep
 
 on:
   schedule:
-    - cron: "0 3 * * SUN"
+    - cron: "0 3 * * *"
   workflow_dispatch:
     inputs:
       issue:
@@ -39,6 +42,7 @@ jobs:
   sweep:
     runs-on: ubuntu-latest
     timeout-minutes: 180
+    environment: CR_PAT
 
     steps:
       - uses: actions/checkout@v5
@@ -77,7 +81,7 @@ jobs:
         if: steps.batch.outputs.count != '0'
         uses: anthropics/claude-code-action@v1
         with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           prompt: |
             The batch of issues to work through is /tmp/ai-fix/batch.json.
             Follow .github/prompts/issue-fix.md exactly. Do not deviate from

.github/workflows/on_issues_ai_triage.yaml

@@ -3,9 +3,10 @@
 #
 # Tier 1. Fires on every new issue, costs cents, finishes in ~2 minutes.
 # Classifies, de-duplicates, asks for missing info, answers simple questions,
-# and applies the `ai-triage` label that tier 2 (weekly_ai_fix.yaml) picks up.
+# and applies the `ai-triage` label that tier 2 (daily_ai_fix.yaml) picks up.
 #
-# Required secret: ANTHROPIC_API_KEY  (or swap to claude_code_oauth_token)
+# Auth: Claude Pro/Max subscription via the CR_PAT GitHub Environment, which
+# holds the CLAUDE_CODE_OAUTH_TOKEN secret (generate with `claude setup-token`).
 
 name: AI issue triage
 
@@ -34,6 +35,7 @@ jobs:
       !contains(github.event.issue.labels.*.name, 'no-ai')
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    environment: CR_PAT
 
     steps:
       # on_issues_ping_submitter.yml has to land first: the classifier reads
@@ -63,7 +65,7 @@ jobs:
       - name: Classify
         uses: anthropics/claude-code-action@v1
         with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           prompt: |
             Read /tmp/ai-triage/context.md, then follow the instructions in
             .github/prompts/issue-classify.md exactly.