feat: basic auth credential and the runner API in client

[grubmeshi]

🤖 Written by AI agent

single-go-bin-runner

building-block-runner moves all its runners into one Go binary. It builds its meshStack client the way the Terraform provider does, through pkg/auth.ResolveClient with its config as a setting source, so it gets the CLI's settings, profiles and OIDC login. Two additions make that possible:

• Basic auth credential. MESHSTACK_API_USERNAME and MESHSTACK_API_PASSWORD resolve a basic auth credential next to the API key. meshstack login --username stores it in the profile and checks it with one request. An Authorization now produces a Credential, which is a BearerToken or a BasicAuth. Basic auth cannot refresh, so a 401 is not retried.
• client.Runner. A runner claims a run, then registers as a status source, reports status and downloads or uploads the plan artifact with the run's token. Registering the source and patching the status are retried on gateway and transport errors. internal/http gains a streaming request and a file body option for the artifacts.

Cross-repo PRs

• refactor: one Go runner binary with an in-process or Kubernetes dispatcher building-block-runner#86: one Go runner binary, which builds its client on this PR

🤖 Generated with Claude Code

[meshcloud-gh-actions]

Coverage of the acceptance run against the meshStack backend, on ebf91ce8485f2643ad149b12a1208eace8e6325c.

Scope	Coverage
Unit tests	78.2%
Acceptance tests	53.7%
Combined	80.3%

Uncovered functions

client/api_key.go:55: meshApiKeyClient.Create 0.0%
client/api_key.go:59: meshApiKeyClient.Read 0.0%
client/api_key.go:63: meshApiKeyClient.Update 0.0%
client/api_key.go:71: meshApiKeyClient.Delete 0.0%
client/api_key_permissions.go:20: ApiKeyPermissions.AllCodes 0.0%
client/api_key_permissions.go:33: ApiKeyPermissions.WorkspaceCodes 0.0%
client/api_key_permissions.go:295: AllApiKeyPermissions 0.0%
client/api_key_permissions.go:299: WorkspacePermissionCodes 0.0%
client/building_block_definition.go:71: MeshBuildingBlockDefinitionApprovalPolicies.NothingRequiresApproval 0.0%
client/building_block_definition.go:82: DisabledSchedule 0.0%
client/building_block_definition.go:89: MeshBuildingBlockDefinitionSchedule.IsDisabled 0.0%
client/building_block_definition.go:93: MeshBuildingBlockDefinitionSpec.HasNeutralPolicies 0.0%
client/building_block_definition.go:97: MeshBuildingBlockDefinitionSpec.WithNeutralPolicies 0.0%
client/building_block_definition.go:166: meshBuildingBlockDefinitionClient.List 0.0%
client/building_block_definition.go:173: meshBuildingBlockDefinitionClient.Read 0.0%
client/building_block_definition.go:177: meshBuildingBlockDefinitionClient.Create 0.0%
client/building_block_definition.go:181: meshBuildingBlockDefinitionClient.Update 0.0%
client/building_block_definition.go:185: meshBuildingBlockDefinitionClient.Delete 0.0%
client/building_block_definition_version.go:100: MeshBuildingBlockType.TagInputTargets 0.0%
client/building_block_definition_version.go:245: meshBuildingBlockDefinitionVersionClient.Create 0.0%
client/building_block_definition_version.go:254: meshBuildingBlockDefinitionVersionClient.Update 0.0%
client/building_block_definition_version_implementation.go:80: MeshBuildingBlockDefinitionImplementation.InferType 0.0%
client/building_block_definition_version_implementation.go:94: MeshBuildingBlockDefinitionImplementation.MarshalJSON 0.0%
client/building_block_definition_version_implementation.go:107: *MeshBuildingBlockDefinitionImplementation.UnmarshalJSON 0.0%
client/building_block_runner.go:82: meshBuildingBlockRunnerClient.Create 0.0%
... and 129 more

covdata func names a method without its receiver, so an entry can belong to an implementation nothing selects rather than to a function the tests never reached. Open the file and line before reading one as a coverage gap.