Subscription (OAuth) and API-key authentication both work. Each run
fails closed with SANDBOX_UNAVAILABLE unless system/init reports only
CLAUDE_READ_ONLY_TOOLS, no MCP server and dontAsk. A new turn
pins a fresh --session-id; a continuation passes --resume. The prompt is one
stream-json user message on stdin, which stays open so cancellation and deadlines
can interrupt the turn (control_request interrupt) before the process is stopped.
Runs one Claude Code turn in restricted, read-only print mode.