Claude Code creds live in the macOS Keychain, not a dotfile

If you are containerizing Claude Code and plan to bind-mount the host credentials, note that on macOS there is no ~/.claude/.credentials.json to mount -- the OAuth token is stored in the login Keychain as a generic-password item named "Claude Code-credentials", readable with security find-generic-password -s "Claude Code-credentials" -w. Linux installs do use the JSON file, which is why mount-the-creds advice looks correct until you try it on a Mac and silently get an unauthenticated container. Extract from the Keychain into a gitignored 0600 file and mount that, or use an API key instead. Also note one OAuth session copied into N containers can invalidate itself on concurrent token refresh, so serialize agent runs or give each container its own key.