fix(release): embed OAuth credentials in release binaries

Release binaries were built without DefaultClientID/DefaultClientSecret,
causing `wk auth manage` to fail with "OAuth credentials not configured"
on clean installs. Add credential ldflags to all 4 goreleaser build
targets and pass WK_CLIENT_ID/WK_CLIENT_SECRET secrets to the workflow.

Author: automagik-genie

.github/workflows/release.yml

@@ -114,3 +114,5 @@ jobs:
           args: release --clean --config /tmp/.goreleaser.yaml --release-notes /tmp/release-notes.md
         env:
           GITHUB_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
+          WK_CLIENT_ID: ${{ secrets.WK_CLIENT_ID }}
+          WK_CLIENT_SECRET: ${{ secrets.WK_CLIENT_SECRET }}

.goreleaser.yaml

@@ -20,6 +20,8 @@ builds:
       -X github.com/automagik-dev/workit/internal/cmd.branch={{ .Branch }}
       -X github.com/automagik-dev/workit/internal/cmd.commit={{ .ShortCommit }}
       -X github.com/automagik-dev/workit/internal/cmd.date={{ .Date }}
+      -X github.com/automagik-dev/workit/internal/config.DefaultClientID={{ .Env.WK_CLIENT_ID }}
+      -X github.com/automagik-dev/workit/internal/config.DefaultClientSecret={{ .Env.WK_CLIENT_SECRET }}
     env:
       - CGO_ENABLED=0
     targets:
@@ -36,6 +38,8 @@ builds:
       -X github.com/automagik-dev/workit/internal/cmd.branch={{ .Branch }}
       -X github.com/automagik-dev/workit/internal/cmd.commit={{ .ShortCommit }}
       -X github.com/automagik-dev/workit/internal/cmd.date={{ .Date }}
+      -X github.com/automagik-dev/workit/internal/config.DefaultClientID={{ .Env.WK_CLIENT_ID }}
+      -X github.com/automagik-dev/workit/internal/config.DefaultClientSecret={{ .Env.WK_CLIENT_SECRET }}
     env:
       - CGO_ENABLED=1
     targets:
@@ -50,6 +54,8 @@ builds:
       -X github.com/automagik-dev/workit/internal/cmd.branch={{ .Branch }}
       -X github.com/automagik-dev/workit/internal/cmd.commit={{ .ShortCommit }}
       -X github.com/automagik-dev/workit/internal/cmd.date={{ .Date }}
+      -X github.com/automagik-dev/workit/internal/config.DefaultClientID={{ .Env.WK_CLIENT_ID }}
+      -X github.com/automagik-dev/workit/internal/config.DefaultClientSecret={{ .Env.WK_CLIENT_SECRET }}
     env:
       - CGO_ENABLED=0
     targets:
@@ -66,6 +72,8 @@ builds:
       -X github.com/automagik-dev/workit/internal/cmd.branch={{ .Branch }}
       -X github.com/automagik-dev/workit/internal/cmd.commit={{ .ShortCommit }}
       -X github.com/automagik-dev/workit/internal/cmd.date={{ .Date }}
+      -X github.com/automagik-dev/workit/internal/config.DefaultClientID={{ .Env.WK_CLIENT_ID }}
+      -X github.com/automagik-dev/workit/internal/config.DefaultClientSecret={{ .Env.WK_CLIENT_SECRET }}
     env:
       - CGO_ENABLED=1
     targets:

install.sh

@@ -415,7 +415,7 @@ if [ ! -t 0 ]; then
     printf "\n"
     printf "Next steps:\n"
     printf "  1. wk auth status                              → check existing accounts\n"
-    printf "  2. wk auth manage --no-input                   → prints auth URL for user\n"
+    printf "  2. wk auth manage                              → connect Google account (prints URL)\n"
     printf "  3. wk gmail search 'newer_than:1d' --json      → first query\n"
     printf "\n"
     printf "Available services: Gmail, Calendar, Drive, Sheets, Docs, Slides,\n"

plugins/workit/skills/setup.md

@@ -101,7 +101,7 @@ wk auth service-account unset
 
 ## 8) Recommended pattern in agents
 1. `wk auth status` — check if account already exists
-2. If not: `wk auth manage --no-input` — prints auth URL for user to open
+2. If not: `wk auth manage` — opens auth (prints URL on headless, browser otherwise)
 3. `wk auth services` — verify services are authorized
 4. Read operations: add `--read-only`
 5. Write operations: `--dry-run` first, then without after confirmation